@pairsystems/goodmem-mcp 0.1.17 → 0.1.18

package/dist/index.js

@@ -20988,7 +20988,21 @@ var StdioServerTransport = class {
 // dist/index.js
 var goodmemBaseUrl = process.env.GOODMEM_BASE_URL || "";
 var goodmemApiKey = process.env.GOODMEM_API_KEY || "";
-var BASED_ON_GOODMEM_COMMIT = "d15028640e4a884f3a648db9b25aee4cdfab719d";
+var DEFAULT_STREAM_MAX_LINE_BYTES = 8 * 1024 * 1024;
+function _parseStreamMaxLineBytes(raw) {
+  if (!raw)
+    return 0;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
+}
+var goodmemStreamMaxLineBytes = _parseStreamMaxLineBytes(process.env.GOODMEM_STREAM_MAX_LINE_BYTES);
+function _concatBytes(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a, 0);
+  out.set(b, a.length);
+  return out;
+}
+var BASED_ON_GOODMEM_COMMIT = "d868460a59745bd219c2b630d843ef6b555e7d35";
 function isConfigured() {
   return goodmemBaseUrl !== "";
 }
@@ -21104,18 +21118,61 @@ async function callApiNdjson(method, path, body, query, timeoutSec) {
     ...body ? { body: JSON.stringify(body) } : {}
   });
   if (!resp.ok) {
-    const text2 = await resp.text();
-    throw new Error(`GoodMem API error ${resp.status}: ${_trimBody(text2)}`);
+    const text = await resp.text();
+    throw new Error(`GoodMem API error ${resp.status}: ${_trimBody(text)}`);
   }
-  const text = await resp.text();
-  const lines = text.split("\n").map((line) => line.trim()).filter(Boolean);
-  return lines.map((line, i) => {
+  const maxLineBytes = goodmemStreamMaxLineBytes > 0 ? goodmemStreamMaxLineBytes : DEFAULT_STREAM_MAX_LINE_BYTES;
+  const results = [];
+  if (resp.body === null) {
+    return results;
+  }
+  const _overCap = () => new Error(`stream event exceeded the ${maxLineBytes}-byte per-event line cap; raise it via the goodmem_configure stream_max_line_bytes option (or the GOODMEM_STREAM_MAX_LINE_BYTES env var), or avoid inlining large bodies by leaving fetch_memory_content unset and fetching content via the memory content tool`);
+  const reader = resp.body.getReader();
+  const decoder = new TextDecoder("utf-8");
+  let pending = new Uint8Array(0);
+  let lineNo = 0;
+  const _emit = (bytes) => {
+    const line = decoder.decode(bytes).trim();
+    if (!line)
+      return;
+    lineNo++;
     try {
-      return JSON.parse(line);
+      results.push(JSON.parse(line));
     } catch (e) {
-      throw new Error(`NDJSON parse error on line ${i + 1}: ${e instanceof Error ? e.message : String(e)}`);
+      throw new Error(`NDJSON parse error on line ${lineNo}: ${e instanceof Error ? e.message : String(e)}`);
     }
-  });
+  };
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (value === void 0 || value.length === 0)
+        continue;
+      pending = pending.length === 0 ? value : _concatBytes(pending, value);
+      let nl;
+      while ((nl = pending.indexOf(10)) !== -1) {
+        const lineBytes = pending.subarray(0, nl);
+        if (lineBytes.length > maxLineBytes)
+          throw _overCap();
+        _emit(lineBytes);
+        pending = pending.subarray(nl + 1);
+      }
+      if (pending.length > maxLineBytes)
+        throw _overCap();
+    }
+    if (pending.length > 0) {
+      if (pending.length > maxLineBytes)
+        throw _overCap();
+      _emit(pending);
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+    }
+  }
+  return results;
 }
 var MODEL_REGISTRY = {
   "embedders": {
@@ -21220,15 +21277,74 @@ var MODEL_REGISTRY = {
       ],
       "maxSequenceLength": 512
     },
-    "jina-embeddings-v4": {
+    "jina-embeddings-v5-text-small": {
       "providerType": "JINA",
       "dimensions": {
         "default": 1024,
-        "allowed": [
-          128,
-          256,
-          512,
-          1024,
+        "range": [
+          1,
+          1024
+        ]
+      },
+      "supportedModalities": [
+        "TEXT"
+      ],
+      "maxSequenceLength": 32768
+    },
+    "jina-embeddings-v5-text-nano": {
+      "providerType": "JINA",
+      "dimensions": {
+        "default": 768,
+        "range": [
+          1,
+          768
+        ]
+      },
+      "supportedModalities": [
+        "TEXT"
+      ],
+      "maxSequenceLength": 8192
+    },
+    "jina-embeddings-v5-omni-small": {
+      "providerType": "JINA",
+      "dimensions": {
+        "default": 1024,
+        "range": [
+          1,
+          1024
+        ]
+      },
+      "supportedModalities": [
+        "TEXT",
+        "IMAGE",
+        "AUDIO",
+        "VIDEO"
+      ],
+      "maxSequenceLength": 32768
+    },
+    "jina-embeddings-v5-omni-nano": {
+      "providerType": "JINA",
+      "dimensions": {
+        "default": 768,
+        "range": [
+          1,
+          768
+        ]
+      },
+      "supportedModalities": [
+        "TEXT",
+        "IMAGE",
+        "AUDIO",
+        "VIDEO"
+      ],
+      "maxSequenceLength": 8192
+    },
+    "jina-embeddings-v4": {
+      "providerType": "JINA",
+      "dimensions": {
+        "default": 1536,
+        "range": [
+          1,
           2048
         ]
       },
@@ -21238,17 +21354,40 @@ var MODEL_REGISTRY = {
       ],
       "maxSequenceLength": 32768
     },
+    "jina-code-embeddings-1.5b": {
+      "providerType": "JINA",
+      "dimensions": {
+        "default": 1536,
+        "range": [
+          1,
+          1536
+        ]
+      },
+      "supportedModalities": [
+        "TEXT"
+      ],
+      "maxSequenceLength": 32768
+    },
+    "jina-code-embeddings-0.5b": {
+      "providerType": "JINA",
+      "dimensions": {
+        "default": 896,
+        "range": [
+          1,
+          896
+        ]
+      },
+      "supportedModalities": [
+        "TEXT"
+      ],
+      "maxSequenceLength": 32768
+    },
     "jina-embeddings-v3": {
       "providerType": "JINA",
       "dimensions": {
         "default": 1024,
-        "allowed": [
-          32,
-          64,
-          128,
-          256,
-          512,
-          768,
+        "range": [
+          1,
           1024
         ]
       },
@@ -21340,12 +21479,8 @@ var MODEL_REGISTRY = {
       "providerType": "JINA",
       "dimensions": {
         "default": 1024,
-        "allowed": [
-          64,
-          128,
-          256,
-          512,
-          768,
+        "range": [
+          1,
           1024
         ]
       },
@@ -21403,6 +21538,22 @@ var MODEL_REGISTRY = {
       ],
       "maxSequenceLength": 32e3
     },
+    "voyage-code-4": {
+      "providerType": "VOYAGE",
+      "dimensions": {
+        "default": 1024,
+        "allowed": [
+          256,
+          512,
+          1024,
+          2048
+        ]
+      },
+      "supportedModalities": [
+        "TEXT"
+      ],
+      "maxSequenceLength": 32e3
+    },
     "voyage-code-3": {
       "providerType": "VOYAGE",
       "dimensions": {
@@ -21876,12 +22027,13 @@ function autoInferFromRegistry(registryType, args) {
 }
 var server = new McpServer({
   name: "goodmem",
-  version: "0.1.17"
+  version: "0.1.18"
 });
 server.tool("goodmem_configure", "Configure GoodMem server connection. Call this before using other GoodMem tools if GOODMEM_BASE_URL and GOODMEM_API_KEY environment variables are not set. Session credentials override environment variables. For bootstrap workflows that need to call /v1/system/info or /v1/system/init before keys exist, api_key may be omitted; most other tools will return AuthenticationException until a real key is provided.", {
   base_url: external_exports.string().describe("GoodMem server URL (e.g., https://your-server.example.com)"),
-  api_key: external_exports.string().describe("GoodMem API key (starts with gm_). Omit for bootstrap-only sessions that call /v1/system/info or /v1/system/init.").optional()
-}, async (args) => {
+  api_key: external_exports.string().describe("GoodMem API key (starts with gm_). Omit for bootstrap-only sessions that call /v1/system/info or /v1/system/init.").optional(),
+  stream_max_line_bytes: external_exports.number().int().positive().describe("Maximum size in bytes of a single NDJSON stream event (memories.retrieve, ping.stream). Events larger than this are rejected instead of buffering without bound. Defaults to 8388608 (8 MiB).").optional()
+}, { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true }, async (args) => {
   if (!/^https?:\/\//i.test(args.base_url)) {
     return { isError: true, content: [{ type: "text", text: `base_url must include a scheme (e.g., http://${args.base_url} or https://${args.base_url}).` }] };
   }
@@ -21904,6 +22056,9 @@ server.tool("goodmem_configure", "Configure GoodMem server connection. Call this
     const info = await resp.json().catch(() => ({}));
     goodmemBaseUrl = args.base_url;
     goodmemApiKey = args.api_key ?? "";
+    if (args.stream_max_line_bytes !== void 0) {
+      goodmemStreamMaxLineBytes = args.stream_max_line_bytes;
+    }
     const keyNote = goodmemApiKey === "" ? " (bootstrap-only session \u2014 no api_key set)" : "";
     return { content: [{ type: "text", text: `Connected to GoodMem at ${goodmemBaseUrl}. Server version: ${info.version ?? "unknown"}.${keyNote}` }] };
   } catch (err) {
@@ -21918,7 +22073,7 @@ server.tool("goodmem_configure", "Configure GoodMem server connection. Call this
 server.tool("goodmem_lookup_model", "Look up a model in the registry to see its provider, endpoint, dimensions, and other auto-inferred fields. Use this to check what models are available before creating an embedder, LLM, or reranker.", {
   model_identifier: external_exports.string().describe("Model name to look up (e.g., text-embedding-3-large, gpt-4o, rerank-2)"),
   type: external_exports.enum(["embedder", "llm", "reranker"]).describe("Model type to search").optional()
-}, async (args) => {
+}, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
   const searches = args.type ? [[args.type + "s", args.type]] : [["embedders", "embedder"], ["llms", "llm"], ["rerankers", "reranker"]];
   for (const [registryKey, label] of searches) {
     const registry2 = MODEL_REGISTRY[registryKey] ?? {};
@@ -21956,19 +22111,166 @@ server.tool("goodmem_lookup_model", "Look up a model in the registry to see its
   return { content: [{ type: "text", text: `Model "${args.model_identifier}" not found in ${scope}. Available models:
 ${allModels.join("\n")}` }] };
 });
-server.tool("goodmem_client_info", "Return the MCP client package version and the goodmem server commit it was built against. No server connection required.", {}, async () => {
+server.tool("goodmem_client_info", "Return the MCP client package version and the goodmem server commit it was built against. No server connection required.", {}, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async () => {
   return { content: [{ type: "text", text: JSON.stringify({
-    mcp_version: "0.1.17",
+    mcp_version: "0.1.18",
     based_on_goodmem_commit: BASED_ON_GOODMEM_COMMIT
   }, null, 2) }] };
 });
 function registerTools() {
+  server.tool("goodmem_access_policy_check", "Check effective authorization\n\nEvaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling. Results are positional and advisory: missing targets and denied operations both return allowed=false, and every later resource request performs fresh authorization. Top-level creates target INSTANCE; CREATE_MEMORY and LIST_MEMORY target their parent SPACE; reads, mutations, proxy operations, and access-policy administration target concrete resources. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY are rejected because their current candidate-based list rules have no instance-wide preflight.", {
+    checks: external_exports.array(external_exports.object({
+      operation: external_exports.enum(["CREATE_USER", "READ_USER", "UPDATE_USER", "DELETE_USER", "LIST_USER", "MANAGE_USER_ENROLLMENT", "CREATE_SERVICE_IDENTITY", "READ_SERVICE_IDENTITY", "UPDATE_SERVICE_IDENTITY", "DELETE_SERVICE_IDENTITY", "LIST_SERVICE_IDENTITY", "CREATE_SPACE", "READ_SPACE", "UPDATE_SPACE", "DELETE_SPACE", "LIST_SPACE", "CREATE_API_KEY", "READ_API_KEY", "UPDATE_API_KEY", "DELETE_API_KEY", "LIST_API_KEY", "CREATE_EMBEDDER", "READ_EMBEDDER", "UPDATE_EMBEDDER", "DELETE_EMBEDDER", "LIST_EMBEDDER", "PING_EMBEDDER", "EXECUTE_EMBEDDER", "READ_EMBEDDER_CREDENTIALS", "CREATE_RERANKER", "READ_RERANKER", "UPDATE_RERANKER", "DELETE_RERANKER", "LIST_RERANKER", "PING_RERANKER", "EXECUTE_RERANKER", "READ_RERANKER_CREDENTIALS", "CREATE_LLM", "READ_LLM", "UPDATE_LLM", "DELETE_LLM", "LIST_LLM", "PING_LLM", "EXECUTE_LLM", "READ_LLM_CREDENTIALS", "PROXY_INFERENCE_TARGET", "OCR_DOCUMENT", "CREATE_MEMORY", "READ_MEMORY", "DELETE_MEMORY", "LIST_MEMORY", "CREATE_EXTENSION", "READ_EXTENSION", "UPDATE_EXTENSION", "DELETE_EXTENSION", "LIST_EXTENSION", "DOWNLOAD_EXTENSION", "READ_INSTANCE", "TRANSFER_INSTANCE_OWNERSHIP", "TRANSFER_RESOURCE_OWNERSHIP", "RELOAD_LICENSE", "DRAIN_SERVER", "PURGE_BACKGROUND_JOBS", "CREATE_RETRIEVE_MEMORY_LOG_POLICY", "READ_RETRIEVE_MEMORY_LOG_POLICY", "LIST_RETRIEVE_MEMORY_LOG_POLICY", "DELETE_RETRIEVE_MEMORY_LOG_POLICY", "MANAGE_ACCESS"]).describe("Operation the caller proposes to perform."),
+      target: external_exports.object({
+        kind: external_exports.enum(["INSTANCE", "USER", "SERVICE_IDENTITY", "SPACE", "API_KEY", "EMBEDDER", "RERANKER", "LLM", "MEMORY", "EXTENSION", "RETRIEVE_MEMORY_LOG_POLICY"]).describe("Concrete target kind."),
+        resourceId: external_exports.string().describe("Concrete resource UUID; omitted for the singleton INSTANCE target.").optional()
+      }).passthrough().describe("Target required by the operation: INSTANCE for top-level creates, parent SPACE for CREATE_MEMORY or LIST_MEMORY, otherwise the concrete resource.")
+    }).passthrough()).describe("Concrete checks evaluated in request order.")
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    const body = {};
+    if (args.checks !== void 0)
+      body["checks"] = args.checks;
+    const result = await callApi("POST", `/v1/access-policy:check`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_access_policy_grants_create", "Create an authorization grant\n\nCreates one direct grant after resolving its typed policy target and requiring MANAGE_ACCESS. Direct grants cannot confer credential-read or ownership-transfer authority. ALL_AUTHENTICATED grants require an assigned-resource selector. MANAGE_ACCESS and MANAGE_USER_ENROLLMENT require a concrete principal and ANY or EXACT; MANAGE_USER_ENROLLMENT with EXACT must target USER.", {
+    grant_id: external_exports.string().describe("Optional caller-provided grant UUID.").optional(),
+    audience: external_exports.object({
+      principalId: external_exports.string().describe("Active HUMAN or SERVICE principal UUID.").optional(),
+      allAuthenticated: external_exports.literal(true).describe("Set to true to address every authenticated principal.").optional()
+    }).passthrough().describe("Audience receiving the grant."),
+    rule: external_exports.object({
+      operation: external_exports.enum(["CREATE_USER", "READ_USER", "UPDATE_USER", "DELETE_USER", "LIST_USER", "MANAGE_USER_ENROLLMENT", "CREATE_SERVICE_IDENTITY", "READ_SERVICE_IDENTITY", "UPDATE_SERVICE_IDENTITY", "DELETE_SERVICE_IDENTITY", "LIST_SERVICE_IDENTITY", "CREATE_SPACE", "READ_SPACE", "UPDATE_SPACE", "DELETE_SPACE", "LIST_SPACE", "CREATE_API_KEY", "READ_API_KEY", "UPDATE_API_KEY", "DELETE_API_KEY", "LIST_API_KEY", "CREATE_EMBEDDER", "READ_EMBEDDER", "UPDATE_EMBEDDER", "DELETE_EMBEDDER", "LIST_EMBEDDER", "PING_EMBEDDER", "EXECUTE_EMBEDDER", "READ_EMBEDDER_CREDENTIALS", "CREATE_RERANKER", "READ_RERANKER", "UPDATE_RERANKER", "DELETE_RERANKER", "LIST_RERANKER", "PING_RERANKER", "EXECUTE_RERANKER", "READ_RERANKER_CREDENTIALS", "CREATE_LLM", "READ_LLM", "UPDATE_LLM", "DELETE_LLM", "LIST_LLM", "PING_LLM", "EXECUTE_LLM", "READ_LLM_CREDENTIALS", "PROXY_INFERENCE_TARGET", "OCR_DOCUMENT", "CREATE_MEMORY", "READ_MEMORY", "DELETE_MEMORY", "LIST_MEMORY", "CREATE_EXTENSION", "READ_EXTENSION", "UPDATE_EXTENSION", "DELETE_EXTENSION", "LIST_EXTENSION", "DOWNLOAD_EXTENSION", "READ_INSTANCE", "TRANSFER_INSTANCE_OWNERSHIP", "TRANSFER_RESOURCE_OWNERSHIP", "RELOAD_LICENSE", "DRAIN_SERVER", "PURGE_BACKGROUND_JOBS", "CREATE_RETRIEVE_MEMORY_LOG_POLICY", "READ_RETRIEVE_MEMORY_LOG_POLICY", "LIST_RETRIEVE_MEMORY_LOG_POLICY", "DELETE_RETRIEVE_MEMORY_LOG_POLICY", "MANAGE_ACCESS"]).describe("Protected operation."),
+      selector: external_exports.enum(["ANY", "OWN", "EXACT", "DIRECT_MEMBERS_OF"]).describe("Resource-selection semantics."),
+      assignedResource: external_exports.object({
+        kind: external_exports.enum(["INSTANCE", "USER", "SERVICE_IDENTITY", "SPACE", "API_KEY", "EMBEDDER", "RERANKER", "LLM", "MEMORY", "EXTENSION", "RETRIEVE_MEMORY_LOG_POLICY"]).describe("Concrete target kind."),
+        resourceId: external_exports.string().describe("Concrete resource UUID; omitted for the singleton INSTANCE target.").optional()
+      }).passthrough().describe("Required exactly for EXACT and DIRECT_MEMBERS_OF selectors.").optional()
+    }).passthrough().describe("Authorization descriptor to grant.")
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
+    const body = {};
+    if (args.grant_id !== void 0)
+      body["grantId"] = args.grant_id;
+    if (args.audience !== void 0)
+      body["audience"] = args.audience;
+    if (args.rule !== void 0)
+      body["rule"] = args.rule;
+    const result = await callApi("POST", `/v1/access-policy/grants`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_access_policy_grants_delete", "Revoke an authorization grant\n\nSoft-revokes one grant and returns its durable historical row. Repeating the request is idempotent while the caller retains MANAGE_ACCESS on the target.", {
+    id: external_exports.string().describe("Grant UUID")
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    await callApi("DELETE", `/v1/access-policy/grants/${encodeURIComponent(String(args.id))}`, void 0);
+    return { content: [{ type: "text", text: "Deleted successfully." }] };
+  });
+  server.tool("goodmem_access_policy_grants_get", "Get an authorization grant\n\nReads one live grant, or one revoked historical grant when include_revoked is true, after requiring MANAGE_ACCESS on its policy target.", {
+    id: external_exports.string().describe("Grant UUID"),
+    include_revoked: external_exports.boolean().describe("Include a revoked historical row").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const query = {};
+    if (args.include_revoked !== void 0)
+      query["includeRevoked"] = String(args.include_revoked);
+    const result = await callApi("GET", `/v1/access-policy/grants/${encodeURIComponent(String(args.id))}`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_access_policy_grants_list", "List authorization grants\n\nLists grants attached to one resource. MANAGE_ACCESS is required on that resource; continuation tokens are bound to the caller and filters.", {
+    resource_kind: external_exports.enum(["INSTANCE", "USER", "SERVICE_IDENTITY", "SPACE", "API_KEY", "EMBEDDER", "RERANKER", "LLM", "MEMORY", "EXTENSION", "RETRIEVE_MEMORY_LOG_POLICY"]).describe("Required target resource kind"),
+    resource_id: external_exports.string().describe("Required target UUID except when resource_kind is INSTANCE").optional(),
+    include_revoked: external_exports.boolean().describe("Include revoked history").optional(),
+    max_results: external_exports.number().int().describe("Page size; 0 or omission uses the default of 50, maximum 1,000").optional(),
+    next_token: external_exports.string().describe("Opaque continuation token").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    const query = {};
+    if (args.resource_kind !== void 0)
+      query["resourceKind"] = String(args.resource_kind);
+    if (args.resource_id !== void 0)
+      query["resourceId"] = String(args.resource_id);
+    if (args.include_revoked !== void 0)
+      query["includeRevoked"] = String(args.include_revoked);
+    if (args.max_results !== void 0)
+      query["maxResults"] = String(args.max_results);
+    if (args.next_token !== void 0)
+      query["nextToken"] = String(args.next_token);
+    const result = await callApi("GET", `/v1/access-policy/grants`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_access_policy_role_assignments_create", "Assign a scoped role\n\nAssigns one code-defined role to an active principal at INSTANCE or SPACE scope after requiring MANAGE_ACCESS. ROOT is maintained only by ownership workflows.", {
+    role_assignment_id: external_exports.string().describe("Optional caller-provided role-assignment UUID.").optional(),
+    principal_id: external_exports.string().describe("Active principal receiving the role."),
+    role: external_exports.enum(["ADMIN", "USER", "SPACE_VIEWER", "SPACE_CONTRIBUTOR", "SPACE_CONTENT_MANAGER", "SPACE_ADMIN"]).describe("Code-defined non-ROOT role to assign."),
+    assigned_resource: external_exports.object({
+      kind: external_exports.enum(["INSTANCE", "SPACE"]).describe("Role-assignment target kind."),
+      resourceId: external_exports.string().describe("Memory-space UUID; omitted for the singleton INSTANCE target.").optional()
+    }).passthrough().describe("INSTANCE or SPACE boundary receiving the assignment.")
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
+    const body = {};
+    if (args.role_assignment_id !== void 0)
+      body["roleAssignmentId"] = args.role_assignment_id;
+    if (args.principal_id !== void 0)
+      body["principalId"] = args.principal_id;
+    if (args.role !== void 0)
+      body["role"] = args.role;
+    if (args.assigned_resource !== void 0)
+      body["assignedResource"] = args.assigned_resource;
+    const result = await callApi("POST", `/v1/access-policy/role-assignments`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_access_policy_role_assignments_delete", "Revoke a scoped role assignment\n\nSoft-revokes one non-ROOT assignment and returns its durable historical row. Repeating the request is idempotent while the caller retains MANAGE_ACCESS.", {
+    id: external_exports.string().describe("Role-assignment UUID")
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    await callApi("DELETE", `/v1/access-policy/role-assignments/${encodeURIComponent(String(args.id))}`, void 0);
+    return { content: [{ type: "text", text: "Deleted successfully." }] };
+  });
+  server.tool("goodmem_access_policy_role_assignments_get", "Get a scoped role assignment\n\nReads one live assignment, or one revoked historical assignment when include_revoked is true, after requiring MANAGE_ACCESS on its policy target.", {
+    id: external_exports.string().describe("Role-assignment UUID"),
+    include_revoked: external_exports.boolean().describe("Include a revoked historical row").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const query = {};
+    if (args.include_revoked !== void 0)
+      query["includeRevoked"] = String(args.include_revoked);
+    const result = await callApi("GET", `/v1/access-policy/role-assignments/${encodeURIComponent(String(args.id))}`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_access_policy_role_assignments_list", "List scoped role assignments\n\nLists assignments attached to one required INSTANCE or SPACE boundary after requiring MANAGE_ACCESS. Continuation tokens are bound to the caller and filters.", {
+    resource_kind: external_exports.enum(["INSTANCE", "SPACE"]).describe("Required INSTANCE or SPACE kind"),
+    resource_id: external_exports.string().describe("Required space UUID; omitted for INSTANCE").optional(),
+    include_revoked: external_exports.boolean().describe("Include revoked history").optional(),
+    max_results: external_exports.number().int().describe("Page size; 0 or omission uses the default of 50, maximum 1,000").optional(),
+    next_token: external_exports.string().describe("Opaque continuation token").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    const query = {};
+    if (args.resource_kind !== void 0)
+      query["resourceKind"] = String(args.resource_kind);
+    if (args.resource_id !== void 0)
+      query["resourceId"] = String(args.resource_id);
+    if (args.include_revoked !== void 0)
+      query["includeRevoked"] = String(args.include_revoked);
+    if (args.max_results !== void 0)
+      query["maxResults"] = String(args.max_results);
+    if (args.next_token !== void 0)
+      query["nextToken"] = String(args.next_token);
+    const result = await callApi("GET", `/v1/access-policy/role-assignments`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
   server.tool("goodmem_admin_background_jobs_purge", "Purge completed background jobs\n\nDeletes terminal background jobs older than a retention cutoff.", {
     older_than: external_exports.string().describe("ISO-8601 timestamp cutoff; only terminal jobs older than this instant are eligible."),
     statuses: external_exports.array(external_exports.enum(["BACKGROUND_JOB_SUCCEEDED", "BACKGROUND_JOB_FAILED", "BACKGROUND_JOB_CANCELED"])).describe("Optional terminal background job statuses to target for purging. If omitted, all terminal statuses are eligible. Canonical values are BACKGROUND_JOB_SUCCEEDED, BACKGROUND_JOB_FAILED, and BACKGROUND_JOB_CANCELED. Short aliases SUCCEEDED, FAILED, and CANCELED are also accepted for compatibility.").optional(),
     dry_run: external_exports.boolean().describe("If true, report purge counts without deleting any rows.").optional(),
     limit: external_exports.number().int().describe("Maximum number of jobs to purge in this request. Must be >= 0; 0 means no limit.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.older_than !== void 0)
       body["olderThan"] = args.older_than;
@@ -21985,7 +22287,7 @@ function registerTools() {
     timeout_sec: external_exports.number().int().describe("Maximum seconds to wait for the server to quiesce before returning.").optional(),
     reason: external_exports.string().describe("Human-readable reason for initiating drain mode.").optional(),
     wait_for_quiesce: external_exports.boolean().describe("If true, wait for in-flight requests to complete and the server to reach QUIESCED before responding.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.timeout_sec !== void 0)
       body["timeoutSec"] = args.timeout_sec;
@@ -21996,7 +22298,7 @@ function registerTools() {
     const result = await callApi("POST", `/v1/admin:drain`, body, void 0, ((args.timeout_sec ?? 900) + 30) * 1e3);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_admin_license_reload", "Reload the active license from disk\n\nTriggers the server to reload its license file from the configured directory and returns metadata about the currently active license.", {}, async (args) => {
+  server.tool("goodmem_admin_license_reload", "Reload the active license from disk\n\nTriggers the server to reload its license file from the configured directory and returns metadata about the currently active license.", {}, { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false }, async (args) => {
     const result = await callApi("POST", `/v1/admin/license:reload`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
@@ -22017,7 +22319,7 @@ function registerTools() {
     active_from: external_exports.number().int().describe("Inclusive activation time in milliseconds since epoch.").optional(),
     active_until: external_exports.number().int().describe("Exclusive deactivation time in milliseconds since epoch.").optional(),
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Operator labels for listing and administration.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.policy_id !== void 0)
       body["policyId"] = args.policy_id;
@@ -22039,7 +22341,7 @@ function registerTools() {
   server.tool("goodmem_admin_retrieve_memory_log_policies_delete", "Delete a RetrieveMemory log policy\n\nIdempotently tombstones an immutable RetrieveMemory log policy.", {
     id: external_exports.string().describe("The UUID of the policy to delete"),
     reason: external_exports.string().describe("Optional tombstone reason.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22052,7 +22354,7 @@ function registerTools() {
   server.tool("goodmem_admin_retrieve_memory_log_policies_get", "Get a RetrieveMemory log policy\n\nRetrieves a live RetrieveMemory log policy by UUID, or a tombstoned policy when include_deleted is true.", {
     id: external_exports.string().describe("The UUID of the policy to retrieve"),
     include_deleted: external_exports.boolean().describe("Whether to include tombstoned policies. Also accepts include_deleted.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22071,7 +22373,7 @@ function registerTools() {
     sort_by: external_exports.enum(["created_at", "updated_at", "display_name"]).describe("Sort field: created_at, updated_at, or display_name. Also accepts sort_by.").optional(),
     sort_order: external_exports.enum(["ASCENDING", "DESCENDING", "SORT_ORDER_UNSPECIFIED"]).describe("Sort order. Also accepts sort_order.").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const query = {};
     if (args.include_deleted !== void 0)
       query["includeDeleted"] = String(args.include_deleted);
@@ -22094,11 +22396,31 @@ function registerTools() {
     const result = await callApi("GET", `/v1/admin/retrieve-memory-log-policies`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_apikeys_create", "Create a new API key\n\nCreates a new API key for authenticating with the API. New keys start in ACTIVE status and can be used immediately for authentication. The response includes the one-time raw API key value which will not be retrievable later - clients must save this value as it cannot be recovered. Requires CREATE_APIKEY_OWN permission (or CREATE_APIKEY_ANY for admin users). Side effects include generating cryptographically secure key material, recording creation timestamp, and tracking creator ID. Returns INVALID_ARGUMENT if expires_at is set to a time in the past.", {
-    labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Key-value pairs of metadata associated with the API key. Used for organization and filtering.").optional(),
-    expires_at: external_exports.number().int().describe("Expiration timestamp in milliseconds since epoch. If not provided, the key does not expire.").optional(),
-    api_key_id: external_exports.string().describe("Optional client-provided UUID for idempotent creation. If not provided, server generates a new UUID. Returns ALREADY_EXISTS if ID is already in use.").optional()
-  }, async (args) => {
+  server.tool("goodmem_admin_transfer_instance_ownership", "Transfer GoodMem instance ownership\n\nTransfers the singleton GoodMem instance to another active human principal. Only the current instance owner may invoke this operation; ADMIN, MANAGE_ACCESS, and ordinary grants are insufficient. Ownership and the synthetic ROOT assignment move atomically. All ordinary roles, including ADMIN, remain unchanged. No credential is created or returned. After an unknown outcome, read the current owner before retrying.", {
+    new_owner_id: external_exports.string().describe("Existing principal UUID that will become the new owner.")
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false }, async (args) => {
+    const body = {};
+    if (args.new_owner_id !== void 0)
+      body["newOwnerId"] = args.new_owner_id;
+    const result = await callApi("POST", `/v1/admin:transferInstanceOwnership`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_apikeys_create", "Create a new API key\n\nIssues a new API key and returns its raw value exactly once. Omitted subject and authority_mode create a self-issued human key that inherits the subject's live authority. A SCOPED key requires a nonempty immutable ceiling, and every ceiling rule must be conservatively covered by both the subject's live authority and the issuing credential's effective authority. A scoped issuer can create only scoped children. SERVICE subjects require SCOPED mode and MANAGE_ACCESS on the service identity. AUTHORIZATION: Requires CREATE_API_KEY on the proposed credential; subject and ceiling checks are repeated by the final insertion statement.", {
+    labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Key-value pairs of metadata associated with the API key. Used for organization and filtering. At most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional(),
+    expires_at: external_exports.number().int().describe("Exclusive expiration timestamp in milliseconds since epoch. It must be later than valid_from, which defaults to issuance time; if omitted, the key does not expire.").optional(),
+    api_key_id: external_exports.string().describe("Optional client-provided UUID for idempotent creation. If not provided, server generates a new UUID. Returns ALREADY_EXISTS if ID is already in use.").optional(),
+    subject_principal_id: external_exports.string().describe("Principal authenticated by this key. Omit to use the authenticated principal.").optional(),
+    authority_mode: external_exports.enum(["INHERIT_SUBJECT", "SCOPED"]).describe("Authority mode. Omit to create a self-issued human key that inherits live authority. A scoped issuing credential may create only SCOPED children.").optional(),
+    ceiling: external_exports.array(external_exports.object({
+      operation: external_exports.enum(["CREATE_USER", "READ_USER", "UPDATE_USER", "DELETE_USER", "LIST_USER", "MANAGE_USER_ENROLLMENT", "CREATE_SERVICE_IDENTITY", "READ_SERVICE_IDENTITY", "UPDATE_SERVICE_IDENTITY", "DELETE_SERVICE_IDENTITY", "LIST_SERVICE_IDENTITY", "CREATE_SPACE", "READ_SPACE", "UPDATE_SPACE", "DELETE_SPACE", "LIST_SPACE", "CREATE_API_KEY", "READ_API_KEY", "UPDATE_API_KEY", "DELETE_API_KEY", "LIST_API_KEY", "CREATE_EMBEDDER", "READ_EMBEDDER", "UPDATE_EMBEDDER", "DELETE_EMBEDDER", "LIST_EMBEDDER", "PING_EMBEDDER", "EXECUTE_EMBEDDER", "READ_EMBEDDER_CREDENTIALS", "CREATE_RERANKER", "READ_RERANKER", "UPDATE_RERANKER", "DELETE_RERANKER", "LIST_RERANKER", "PING_RERANKER", "EXECUTE_RERANKER", "READ_RERANKER_CREDENTIALS", "CREATE_LLM", "READ_LLM", "UPDATE_LLM", "DELETE_LLM", "LIST_LLM", "PING_LLM", "EXECUTE_LLM", "READ_LLM_CREDENTIALS", "PROXY_INFERENCE_TARGET", "OCR_DOCUMENT", "CREATE_MEMORY", "READ_MEMORY", "DELETE_MEMORY", "LIST_MEMORY", "CREATE_EXTENSION", "READ_EXTENSION", "UPDATE_EXTENSION", "DELETE_EXTENSION", "LIST_EXTENSION", "DOWNLOAD_EXTENSION", "READ_INSTANCE", "TRANSFER_INSTANCE_OWNERSHIP", "TRANSFER_RESOURCE_OWNERSHIP", "RELOAD_LICENSE", "DRAIN_SERVER", "PURGE_BACKGROUND_JOBS", "CREATE_RETRIEVE_MEMORY_LOG_POLICY", "READ_RETRIEVE_MEMORY_LOG_POLICY", "LIST_RETRIEVE_MEMORY_LOG_POLICY", "DELETE_RETRIEVE_MEMORY_LOG_POLICY", "MANAGE_ACCESS"]).describe("Protected operation."),
+      selector: external_exports.enum(["ANY", "OWN", "EXACT", "DIRECT_MEMBERS_OF"]).describe("Resource-selection semantics."),
+      assignedResource: external_exports.object({
+        kind: external_exports.enum(["INSTANCE", "USER", "SERVICE_IDENTITY", "SPACE", "API_KEY", "EMBEDDER", "RERANKER", "LLM", "MEMORY", "EXTENSION", "RETRIEVE_MEMORY_LOG_POLICY"]).describe("Concrete target kind."),
+        resourceId: external_exports.string().describe("Concrete resource UUID; omitted for the singleton INSTANCE target.").optional()
+      }).passthrough().describe("Required exactly for EXACT and DIRECT_MEMBERS_OF selectors.").optional()
+    }).passthrough()).describe("Immutable authorization ceiling. Required and nonempty for SCOPED; omitted for INHERIT_SUBJECT, with at most 1,000 rules. Every rule must be covered by both the subject's live authority and the issuing credential's effective authority.").optional(),
+    valid_from: external_exports.number().int().describe("Inclusive activation time in epoch milliseconds. Omit to activate at issuance time.").optional()
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.labels !== void 0)
       body["labels"] = args.labels;
@@ -22106,28 +22428,65 @@ function registerTools() {
       body["expiresAt"] = args.expires_at;
     if (args.api_key_id !== void 0)
       body["apiKeyId"] = args.api_key_id;
+    if (args.subject_principal_id !== void 0)
+      body["subjectPrincipalId"] = args.subject_principal_id;
+    if (args.authority_mode !== void 0)
+      body["authorityMode"] = args.authority_mode;
+    if (args.ceiling !== void 0)
+      body["ceiling"] = args.ceiling;
+    if (args.valid_from !== void 0)
+      body["validFrom"] = args.valid_from;
     const result = await callApi("POST", `/v1/apikeys`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_apikeys_delete", 'Delete an API key\n\nPermanently deletes an API key. This operation cannot be undone and immediately invalidates the key for all future authentication attempts. TIP: For reversible deactivation, use the `goodmem_apikeys_update` tool with `status: "INACTIVE"` instead. Requires DELETE_APIKEY_OWN permission for keys you own (or DELETE_APIKEY_ANY for admin users to delete any user\'s keys). Side effects include permanently removing the key record from the database and immediate authentication invalidation.', {
+  server.tool("goodmem_apikeys_delete", 'Delete an API key\n\nPermanently revokes an API key and immediately rejects it for future authentication. The durable credential and audit history remain stored. This operation requires DELETE_API_KEY and records the revocation time and actor; it cannot be undone. The `goodmem_apikeys_update` tool with `status: "INACTIVE"` performs the same permanent revocation; revoked keys cannot be reactivated.', {
     id: external_exports.string().describe("The UUID of the API key to delete")
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
     await callApi("DELETE", `/v1/apikeys/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_apikeys_list", "List API keys\n\nRetrieves a list of API keys belonging to the authenticated user. The list includes metadata about each key but not the actual key values or key hashes for security reasons. Requires LIST_APIKEY_OWN permission (or LIST_APIKEY_ANY for admin users to view keys from any user). This is a read-only operation with no side effects.", {}, async (args) => {
-    const result = await callApi("GET", `/v1/apikeys`, void 0);
+  server.tool("goodmem_apikeys_get", "Get an API key\n\nReturns complete non-secret metadata for one existing credential after requiring effective READ_API_KEY authority. The immutable ceiling is always complete and ceilingOmitted is false. Raw key material and hashes are never returned.", {
+    id: external_exports.string().describe("API-key UUID")
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const result = await callApi("GET", `/v1/apikeys/${encodeURIComponent(String(args.id))}`, void 0);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_apikeys_list", "List API keys\n\nRetrieves one UUID-ordered page of API keys discoverable under the authenticated principal's effective API-key policy. Subject, owner, and lifecycle filters are applied after authorization. FULL includes complete immutable ceilings; BASIC omits them, sets ceilingOmitted=true, and permits larger pages. Raw key values and key hashes are never returned.", {
+    subject_principal_id: external_exports.string().describe("Filter by exact subject-principal UUID").optional(),
+    owner_principal_id: external_exports.string().describe("Filter by exact administrative-owner UUID").optional(),
+    lifecycle_state: external_exports.enum(["NOT_YET_VALID", "USABLE", "EXPIRED", "REVOKED"]).describe("Filter by precise lifecycle state").optional(),
+    view: external_exports.enum(["FULL", "BASIC"]).describe("Metadata projection; omission defaults to FULL").optional(),
+    max_results: external_exports.number().int().describe("Page size; FULL defaults to 10 and permits at most 20, while BASIC defaults to 50 and permits at most 1,000").optional(),
+    next_token: external_exports.string().describe("Opaque continuation token returned by the preceding page").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    const query = {};
+    if (args.subject_principal_id !== void 0)
+      query["subjectPrincipalId"] = String(args.subject_principal_id);
+    if (args.owner_principal_id !== void 0)
+      query["ownerPrincipalId"] = String(args.owner_principal_id);
+    if (args.lifecycle_state !== void 0)
+      query["lifecycleState"] = String(args.lifecycle_state);
+    if (args.view !== void 0)
+      query["view"] = String(args.view);
+    if (args.max_results !== void 0)
+      query["maxResults"] = String(args.max_results);
+    if (args.next_token !== void 0)
+      query["nextToken"] = String(args.next_token);
+    const result = await callApi("GET", `/v1/apikeys`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_apikeys_update", "Update an API key\n\nUpdates an existing API key with new values for status or labels. IMPORTANT: Key ID, user ownership, key material, and audit fields cannot be modified - only status (ACTIVE/INACTIVE) and labels are mutable. Requires UPDATE_APIKEY_OWN permission for keys you own (or UPDATE_APIKEY_ANY for admin users to modify any user's keys). Side effects include updating the updated_at timestamp and recording the updater's user ID. This operation is idempotent - repeated identical requests have no additional effect.", {
+  server.tool("goodmem_apikeys_update", "Update an API key\n\nUpdates an existing API key's labels or lifecycle status. Key ID, subject, ownership, key material, validity window, and creation audit fields remain immutable. Label changes require UPDATE_API_KEY; setting status=INACTIVE permanently revokes the key and requires DELETE_API_KEY; a request doing both requires both operations. Revoked keys cannot be reactivated. Side effects include updating administrative audit fields and, for revocation, recording the revocation time and actor.", {
     id: external_exports.string().describe("The UUID of the API key to update"),
-    status: external_exports.enum(["ACTIVE", "INACTIVE"]).describe("New status for the API key. Allowed values: ACTIVE, INACTIVE.").optional(),
-    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with this set. Mutually exclusive with merge_labels.").optional(),
-    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones. Mutually exclusive with replace_labels.").optional()
-  }, async (args) => {
+    status: external_exports.enum(["ACTIVE", "INACTIVE"]).describe("New status for the API key. INACTIVE is permanent; revoked keys cannot be reactivated.").optional(),
+    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with this set. Mutually exclusive with merge_labels. The stored map may contain at most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional(),
+    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones. Mutually exclusive with replace_labels. The final stored map may contain at most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional()
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22145,12 +22504,12 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/apikeys/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_embedders_create", "Create a new embedder\n\nCreates a new embedder configuration for vectorizing content. Embedders represent connections to different embedding API services (like OpenAI, vLLM, etc.) and include all the necessary configuration to use them with memory spaces. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another embedder exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, dimensionality, distribution_type, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner, allowing different users to have identical configurations. Credentials are hashed (SHA-256) for uniqueness while remaining encrypted. The api_path field defaults to '/v2/embed' for Cohere, '/embed' for TEI, and '/embeddings' for other providers when omitted. Requires CREATE_EMBEDDER_OWN permission (or CREATE_EMBEDDER_ANY for admin users).", {
+  server.tool("goodmem_embedders_create", "Create a new embedder\n\nCreates a new embedder configuration for vectorizing content. Embedders represent connections to different embedding API services (like OpenAI, vLLM, etc.) and include all the necessary configuration to use them with memory spaces. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another embedder exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, dimensionality, distribution_type, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner, allowing different users to have identical configurations. A SHA-256 credential fingerprint participates in uniqueness checking. The api_path field defaults to '/v2/embed' for Cohere, '/v1/embeddings' for Jina, '/embed' for TEI, and '/embeddings' for other providers when omitted. OWNER DEFAULTS: Owner defaults to the authenticated principal unless owner_id is provided; CREATE_EMBEDDER is evaluated against the proposed embedder and owner.", {
     display_name: external_exports.string().describe("User-facing name of the embedder"),
     description: external_exports.string().describe("Description of the embedder").optional(),
     provider_type: external_exports.enum(["OPENAI", "VLLM", "TEI", "LLAMA_CPP", "VOYAGE", "COHERE", "JINA"]).describe("Type of embedding provider (auto-inferred from model_identifier if omitted)").optional(),
     endpoint_url: external_exports.string().describe("API endpoint URL (auto-inferred from model_identifier if omitted)").optional(),
-    api_path: external_exports.string().describe("API path for embeddings request (defaults: Cohere /v2/embed, TEI /embed, others /embeddings)").optional(),
+    api_path: external_exports.string().describe("API path for embeddings requests (defaults: Cohere /v2/embed, Jina /v1/embeddings, TEI /embed, others /embeddings)").optional(),
     model_identifier: external_exports.string().describe("Model identifier"),
     dimensionality: external_exports.number().int().describe("Output vector dimensions (auto-inferred from model_identifier if omitted)").optional(),
     distribution_type: external_exports.enum(["DENSE", "SPARSE"]).describe("Type of embedding distribution (DENSE or SPARSE) (auto-inferred from model_identifier if omitted)").optional(),
@@ -22176,9 +22535,9 @@ function registerTools() {
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("User-defined labels for categorization").optional(),
     version: external_exports.string().describe("Version information").optional(),
     monitoring_endpoint: external_exports.string().describe("Monitoring endpoint URL").optional(),
-    owner_id: external_exports.string().describe("Optional owner ID. If not provided, derived from the authentication context. Requires CREATE_EMBEDDER_ANY permission if specified.").optional(),
+    owner_id: external_exports.string().describe("Optional owner principal UUID. If omitted, defaults to the authenticated principal. CREATE_EMBEDDER is evaluated against the proposed embedder and owner.").optional(),
     embedder_id: external_exports.string().describe("Optional client-provided UUID for idempotent creation. If not provided, server generates a new UUID. Returns ALREADY_EXISTS if ID is already in use.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const inferred = autoInferFromRegistry("embedders", args);
     checkCredentialRequired(inferred);
     const body = {};
@@ -22217,29 +22576,33 @@ function registerTools() {
     const result = await callApi("POST", `/v1/embedders`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_embedders_delete", "Delete an embedder\n\nPermanently deletes an embedder configuration. This operation cannot be undone and removes the embedder record and securely deletes stored credentials. IMPORTANT: This does NOT invalidate or delete embeddings previously created with this embedder - existing embeddings remain accessible. CONFLICT: Returns HTTP 409 Conflict if the embedder is still referenced by a space. Requires DELETE_EMBEDDER_OWN permission for embedders you own (or DELETE_EMBEDDER_ANY for admin users).", {
+  server.tool("goodmem_embedders_delete", "Delete an embedder\n\nPermanently deletes an embedder configuration. This operation cannot be undone and removes the embedder record and securely deletes stored credentials. IMPORTANT: This does NOT invalidate or delete embeddings previously created with this embedder - existing embeddings remain accessible. CONFLICT: Returns HTTP 409 Conflict if the embedder is still referenced by a space. Requires DELETE_EMBEDDER on the requested embedder.", {
     id: external_exports.string().describe("The unique identifier of the embedder to delete")
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
     await callApi("DELETE", `/v1/embedders/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_embedders_get", "Get an embedder by ID\n\nRetrieves the details of a specific embedder configuration by its unique identifier. Requires READ_EMBEDDER_OWN permission for embedders you own (or READ_EMBEDDER_ANY for admin users to view any user's embedders). This is a read-only operation with no side effects.", {
-    id: external_exports.string().describe("The unique identifier of the embedder to retrieve")
-  }, async (args) => {
+  server.tool("goodmem_embedders_get", "Get an embedder by ID\n\nRetrieves the details of a specific embedder configuration by its unique identifier. Requires READ_EMBEDDER on the requested embedder. The service distinguishes a missing embedder from an existing embedder the caller cannot read. This is a read-only operation with no side effects.", {
+    id: external_exports.string().describe("The unique identifier of the embedder to retrieve"),
+    include_credentials: external_exports.boolean().describe("Whether to return stored credentials. Also accepts include_credentials. Requires READ_EMBEDDER_CREDENTIALS in addition to READ_EMBEDDER.").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
-    const result = await callApi("GET", `/v1/embedders/${encodeURIComponent(String(args.id))}`, void 0);
+    const query = {};
+    if (args.include_credentials !== void 0)
+      query["includeCredentials"] = String(args.include_credentials);
+    const result = await callApi("GET", `/v1/embedders/${encodeURIComponent(String(args.id))}`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_embedders_list", "List embedders\n\nRetrieves a list of embedder configurations accessible to the caller, with optional filtering. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). PERMISSION-BASED FILTERING: With LIST_EMBEDDER_OWN permission, you can only see your own embedders (owner_id filter is ignored if set to another user). With LIST_EMBEDDER_ANY permission, you can see all embedders or filter by any owner_id. This is a read-only operation with no side effects.", {
-    owner_id: external_exports.string().describe("Filter embedders by owner ID. With LIST_EMBEDDER_ANY permission, omitting this shows all accessible embedders; providing it filters by that owner. With LIST_EMBEDDER_OWN permission, only your own embedders are shown regardless of this parameter.").optional(),
+  server.tool("goodmem_embedders_list", "List embedders\n\nRetrieves a list of embedder configurations accessible to the caller, with optional filtering. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). AUTHORIZATION: Requires LIST_EMBEDDER on the GoodMem instance. Each returned embedder must also be visible through READ_EMBEDDER; unauthorized embedders are filtered in PostgreSQL. The owner_id parameter filters that already-authorized result set and does not grant additional visibility. This is a read-only operation with no side effects.", {
+    owner_id: external_exports.string().describe("Filter the already-authorized result set by owner principal UUID. Omitting this parameter does not bypass per-embedder READ_EMBEDDER filtering.").optional(),
     provider_type: external_exports.enum(["OPENAI", "VLLM", "TEI", "LLAMA_CPP", "VOYAGE", "COHERE", "JINA"]).describe("Filter embedders by provider type. Allowed values match the ProviderType schema.").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const query = {};
     if (args.owner_id !== void 0)
       query["ownerId"] = String(args.owner_id);
@@ -22252,12 +22615,12 @@ function registerTools() {
     const result = await callApi("GET", `/v1/embedders`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_embedders_update", "Update an embedder\n\nUpdates an existing embedder configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. IMPORTANT: providerType is IMMUTABLE after creation and cannot be changed. CRITICAL: Returns HTTP 412 Precondition Failed (FAILED_PRECONDITION) if attempting to update core fields (dimensionality, distribution_type, model_identifier) while the embedder is actively referenced by spaces or ingestion jobs. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if the update would create a duplicate embedder with the same provider, endpoint, model, dimensionality, distribution, and credentials for this owner. Requires UPDATE_EMBEDDER_OWN permission for embedders you own (or UPDATE_EMBEDDER_ANY for admin users).", {
+  server.tool("goodmem_embedders_update", "Update an embedder\n\nUpdates an existing embedder configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. Omitting api_path preserves the existing path; setting it blank resets it to '/v2/embed' for Cohere, '/v1/embeddings' for Jina, '/embed' for TEI, or '/embeddings' for other providers. IMPORTANT: providerType is IMMUTABLE after creation and cannot be changed. CRITICAL: Returns HTTP 412 Precondition Failed (FAILED_PRECONDITION) if attempting to update core fields (dimensionality, distribution_type, model_identifier) while the embedder is actively referenced by spaces or ingestion jobs. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if the update would create a duplicate embedder with the same provider, endpoint, model, dimensionality, distribution, and credentials for this owner. Requires UPDATE_EMBEDDER on the requested embedder.", {
     id: external_exports.string().describe("The unique identifier of the embedder to update"),
     display_name: external_exports.string().describe("User-facing name of the embedder").optional(),
     description: external_exports.string().describe("Description of the embedder").optional(),
     endpoint_url: external_exports.string().describe("API endpoint URL").optional(),
-    api_path: external_exports.string().describe("API path for embeddings request").optional(),
+    api_path: external_exports.string().describe("API path for embeddings requests. Omit to keep the existing path; set blank to reset to the provider default (Cohere /v2/embed, Jina /v1/embeddings, TEI /embed, others /embeddings).").optional(),
     model_identifier: external_exports.string().describe("Model identifier").optional(),
     dimensionality: external_exports.number().int().describe("Output vector dimensions").optional(),
     distribution_type: external_exports.enum(["DENSE", "SPARSE"]).describe("Type of embedding distribution (DENSE or SPARSE)").optional(),
@@ -22278,12 +22641,12 @@ function registerTools() {
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
       labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
-    }).passthrough().describe("Structured credential payload describing how to authenticate with the provider").optional(),
+    }).passthrough().describe("Replace stored credentials. Omit this field to preserve the current credentials; a present empty payload is invalid and never clears them.").optional(),
     replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with these (mutually exclusive with merge_labels)").optional(),
     merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones (mutually exclusive with replace_labels)").optional(),
     version: external_exports.string().describe("Version information").optional(),
     monitoring_endpoint: external_exports.string().describe("Monitoring endpoint URL").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22321,7 +22684,11 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/embedders/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_llms_create", "Create a new LLM\n\nCreates a new LLM configuration for text generation services. LLMs represent connections to different language model API services (like OpenAI, vLLM, etc.) and include all the necessary configuration to use them for text generation. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another LLM exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner. Credentials are hashed (SHA-256) for uniqueness while remaining encrypted. The api_path field defaults to '/chat/completions' if omitted. Requires CREATE_LLM_OWN permission (or CREATE_LLM_ANY for admin users).", {
+  server.tool("goodmem_instance_get", "Get the GoodMem instance\n\nReturns singleton instance identity, ownership, and audit metadata after requiring effective READ_INSTANCE authority. The built-in ADMIN role supplies this authority; instance ownership alone does not. A scoped API key must also retain READ_INSTANCE in its immutable ceiling. This operation does not expose credentials or mutate instance state.", {}, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    const result = await callApi("GET", `/v1/instance`, void 0);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_llms_create", "Create a new LLM\n\nCreates a new LLM configuration for text generation services. LLMs represent connections to different language model API services (like OpenAI, vLLM, etc.) and include all the necessary configuration to use them for text generation. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another LLM exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner. Credentials are hashed (SHA-256) for uniqueness while remaining encrypted. The api_path field defaults to '/chat/completions' if omitted. OWNER DEFAULTS: Owner defaults to the authenticated principal unless owner_id is provided; CREATE_LLM is evaluated against the proposed LLM and owner.", {
     display_name: external_exports.string().describe("User-facing name of the LLM"),
     description: external_exports.string().describe("Description of the LLM").optional(),
     provider_type: external_exports.enum(["OPENAI", "LITELLM_PROXY", "OPEN_ROUTER", "VLLM", "OLLAMA", "LLAMA_CPP", "CUSTOM_OPENAI_COMPATIBLE"]).describe("Type of LLM provider (auto-inferred from model_identifier if omitted)").optional(),
@@ -22368,9 +22735,9 @@ function registerTools() {
     }).passthrough().describe("Default sampling parameters for generation requests").optional(),
     max_context_length: external_exports.number().int().describe("Maximum context window size in tokens").optional(),
     client_config: external_exports.record(external_exports.string(), external_exports.any()).describe("Provider-specific client configuration as flexible JSON structure").optional(),
-    owner_id: external_exports.string().describe("Optional owner ID. If not provided, derived from the authentication context. Requires CREATE_LLM_ANY permission if specified.").optional(),
+    owner_id: external_exports.string().describe("Optional owner principal UUID. If omitted, defaults to the authenticated principal. CREATE_LLM is evaluated against the proposed LLM and owner.").optional(),
     llm_id: external_exports.string().describe("Optional client-provided UUID for idempotent creation. If not provided, server generates a new UUID. Returns ALREADY_EXISTS if ID is already in use.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const inferred = autoInferFromRegistry("llms", args);
     checkCredentialRequired(inferred);
     const body = {};
@@ -22411,29 +22778,33 @@ function registerTools() {
     const result = await callApi("POST", `/v1/llms`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_llms_delete", "Delete an LLM\n\nPermanently deletes an LLM configuration. This operation cannot be undone and removes the LLM record and securely deletes stored credentials. IMPORTANT: This does NOT invalidate or delete any previously generated content using this LLM - existing generations remain accessible. Requires DELETE_LLM_OWN permission for LLMs you own (or DELETE_LLM_ANY for admin users).", {
+  server.tool("goodmem_llms_delete", "Delete an LLM\n\nPermanently deletes an LLM configuration. This operation cannot be undone and removes the LLM record and securely deletes stored credentials. IMPORTANT: This does NOT invalidate or delete any previously generated content using this LLM - existing generations remain accessible. Requires DELETE_LLM on the requested LLM.", {
     id: external_exports.string().describe("The unique identifier of the LLM to delete")
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
     await callApi("DELETE", `/v1/llms/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_llms_get", "Get an LLM by ID\n\nRetrieves the details of a specific LLM configuration by its unique identifier. Requires READ_LLM_OWN permission for LLMs you own (or READ_LLM_ANY for admin users to view any user's LLMs). This is a read-only operation with no side effects.", {
-    id: external_exports.string().describe("The unique identifier of the LLM to retrieve")
-  }, async (args) => {
+  server.tool("goodmem_llms_get", "Get an LLM by ID\n\nRetrieves the details of a specific LLM configuration by its unique identifier. Requires READ_LLM on the requested LLM. The service distinguishes a missing LLM from an existing LLM the caller cannot read. This is a read-only operation with no side effects.", {
+    id: external_exports.string().describe("The unique identifier of the LLM to retrieve"),
+    include_credentials: external_exports.boolean().describe("Whether to return stored credentials. Also accepts include_credentials. Requires READ_LLM_CREDENTIALS in addition to READ_LLM.").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
-    const result = await callApi("GET", `/v1/llms/${encodeURIComponent(String(args.id))}`, void 0);
+    const query = {};
+    if (args.include_credentials !== void 0)
+      query["includeCredentials"] = String(args.include_credentials);
+    const result = await callApi("GET", `/v1/llms/${encodeURIComponent(String(args.id))}`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_llms_list", "List LLMs\n\nRetrieves a list of LLM configurations accessible to the caller, with optional filtering. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). PERMISSION-BASED FILTERING: With LIST_LLM_OWN permission, you can only see your own LLMs (owner_id filter is ignored if set to another user). With LIST_LLM_ANY permission, you can see all LLMs or filter by any owner_id. This is a read-only operation with no side effects.", {
-    owner_id: external_exports.string().describe("Filter LLMs by owner ID. With LIST_LLM_ANY permission, omitting this shows all accessible LLMs; providing it filters by that owner. With LIST_LLM_OWN permission, only your own LLMs are shown regardless of this parameter.").optional(),
+  server.tool("goodmem_llms_list", "List LLMs\n\nRetrieves a list of LLM configurations accessible to the caller, with optional filtering. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). AUTHORIZATION: Requires LIST_LLM on the GoodMem instance. Each returned LLM must also be visible through READ_LLM; unauthorized LLMs are filtered in PostgreSQL. The owner_id parameter filters that already-authorized result set and does not grant additional visibility. This is a read-only operation with no side effects.", {
+    owner_id: external_exports.string().describe("Filter the already-authorized result set by owner principal UUID. Omitting this parameter does not bypass per-LLM READ_LLM filtering.").optional(),
     provider_type: external_exports.enum(["OPENAI", "LITELLM_PROXY", "OPEN_ROUTER", "VLLM", "OLLAMA", "LLAMA_CPP", "CUSTOM_OPENAI_COMPATIBLE"]).describe("Filter LLMs by provider type. Allowed values match the LLMProviderType schema.").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const query = {};
     if (args.owner_id !== void 0)
       query["ownerId"] = String(args.owner_id);
@@ -22446,7 +22817,7 @@ function registerTools() {
     const result = await callApi("GET", `/v1/llms`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_llms_update", "Update an LLM\n\nUpdates an existing LLM configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. SUPPORTED_MODALITIES UPDATE: If the array contains >=1 elements, it replaces the stored set; if empty or omitted, no change occurs and it does not count as an update by itself. IMPORTANT: providerType is IMMUTABLE after creation and cannot be changed. Requires UPDATE_LLM_OWN permission for LLMs you own (or UPDATE_LLM_ANY for admin users).", {
+  server.tool("goodmem_llms_update", "Update an LLM\n\nUpdates an existing LLM configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. SUPPORTED_MODALITIES UPDATE: If the array contains >=1 elements, it replaces the stored set; if empty or omitted, no change occurs and it does not count as an update by itself. IMPORTANT: providerType is IMMUTABLE after creation and cannot be changed. Requires UPDATE_LLM on the requested LLM.", {
     id: external_exports.string().describe("The unique identifier of the LLM to update"),
     display_name: external_exports.string().describe("Update display name").optional(),
     description: external_exports.string().describe("Update description").optional(),
@@ -22470,7 +22841,7 @@ function registerTools() {
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
       labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
-    }).passthrough().describe("Update credentials").optional(),
+    }).passthrough().describe("Replace stored credentials. Omit this field to preserve the current credentials; a present empty payload is invalid and never clears them.").optional(),
     version: external_exports.string().describe("Update version information").optional(),
     monitoring_endpoint: external_exports.string().describe("Update monitoring endpoint URL").optional(),
     capabilities: external_exports.object({
@@ -22494,7 +22865,7 @@ function registerTools() {
     client_config: external_exports.record(external_exports.string(), external_exports.any()).describe("Update provider-specific client configuration (replaces entire config; no merging)").optional(),
     replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with this set. Empty map clears all labels. Cannot be used with merge_labels.").optional(),
     merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge with existing labels: upserts with overwrite. Labels not mentioned are preserved. Cannot be used with replace_labels.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22564,7 +22935,7 @@ function registerTools() {
       }).passthrough().describe("Chunking strategy for this memory (if not provided, uses space default)").optional(),
       extractPageImages: external_exports.boolean().describe("Optional hint to extract page images for eligible document types (for example, PDFs)").optional()
     }).passthrough()).describe("Array of memory creation requests.")
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     for (const [_i, _item] of (Array.isArray(args.requests) ? args.requests : []).entries()) {
       const _itemSet = [_item?.["originalContent"] !== void 0 && _item?.["originalContent"] !== null, _item?.["originalContentB64"] !== void 0 && _item?.["originalContentB64"] !== null].filter(Boolean).length;
       if (_itemSet !== 1) {
@@ -22588,7 +22959,7 @@ function registerTools() {
     const result = await callApi("POST", `/v1/memories:batchCreate`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_batch_delete", "Delete memories in batch\n\nDeletes memories using selector entries. Each selector can target either a specific memory ID or a filtered subset scoped to a specific space.", {
+  server.tool("goodmem_memories_batch_delete", "Delete memories in batch\n\nDeletes memories using selector entries. Each selector can target either a specific memory ID or a filtered subset scoped to a specific space. Each selected memory requires DELETE_MEMORY; authority may be granted through DIRECT_MEMBERS_OF its containing space.", {
     requests: external_exports.array(external_exports.object({
       memoryId: external_exports.string().describe("Deletes one specific memory by UUID").optional(),
       filterSelector: external_exports.object({
@@ -22597,18 +22968,18 @@ function registerTools() {
         filter: external_exports.string().describe("Optional metadata filter expression").optional()
       }).passthrough().describe("Deletes a filtered set of memories within a specific space").optional()
     }).passthrough()).describe("Array of delete selectors")
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.requests !== void 0)
       body["requests"] = args.requests;
     const result = await callApi("POST", `/v1/memories:batchDelete`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_batch_get", "Get multiple memories by ID\n\nRetrieves multiple memories in a single operation, with individual success/failure results.", {
+  server.tool("goodmem_memories_batch_get", "Get multiple memories by ID\n\nRetrieves multiple memories in a single operation, with individual success/failure results. Each item requires READ_MEMORY on the requested memory; authority may be granted through DIRECT_MEMBERS_OF its containing space.", {
     memory_ids: external_exports.array(external_exports.string()).describe("Array of memory IDs to retrieve"),
     include_content: external_exports.boolean().describe("Whether to include the original content in the response").optional(),
     include_processing_history: external_exports.boolean().describe("Whether to include background job processing history for each memory").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.memory_ids !== void 0)
       body["memoryIds"] = args.memory_ids;
@@ -22619,10 +22990,10 @@ function registerTools() {
     const result = await callApi("POST", `/v1/memories:batchGet`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_content", "Download memory content\n\nReturns the original binary payload for a memory. The response uses the memory's stored content type when available. Returns 404 when the memory does not have inline content; clients can check originalContentRef from the metadata endpoint to locate external content.", {
+  server.tool("goodmem_memories_content", "Download memory content\n\nReturns the original binary payload for a memory. The response uses the memory's stored content type when available. Returns 404 when the memory does not have inline content; clients can check originalContentRef from the metadata endpoint to locate external content. Requires READ_MEMORY on the requested memory; authority may be granted through DIRECT_MEMBERS_OF its containing space.", {
     id: external_exports.string().describe("The UUID of the memory to download"),
     max_inline_bytes: external_exports.number().int().positive().describe("Maximum bytes to deliver inline as a content block. Defaults to 8388608. Hard server ceiling: 67108864. If the payload exceeds this cap the tool errors with the actual size \u2014 retry with a larger value (up to the ceiling) to receive it.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22668,7 +23039,7 @@ function registerTools() {
       }).passthrough().describe("Sentence-based chunking strategy with language detection").optional()
     }).passthrough().describe("Chunking strategy for this memory (if not provided, uses space default)").optional(),
     extract_page_images: external_exports.boolean().describe("Optional hint to extract page images for eligible document types (for example, PDFs)").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const _set = [args.original_content !== void 0 && args.original_content !== null, args.original_content_b64 !== void 0 && args.original_content_b64 !== null].filter(Boolean).length;
     if (_set !== 1) {
       throw new Error("exactly one of original_content or original_content_b64 must be set");
@@ -22701,20 +23072,20 @@ function registerTools() {
     const result = await callApi("POST", `/v1/memories`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_delete", "Delete a memory\n\nPermanently deletes a memory and its associated chunks. This operation cannot be undone and immediately removes the memory record from the database. IDEMPOTENCY: This operation is safe to retry - may return NOT_FOUND if the memory was already deleted or never existed. Requires DELETE_MEMORY_OWN permission for memories in spaces you own (or DELETE_MEMORY_ANY for admin users to delete any memory). Side effects include permanent removal of the memory record and all associated chunk data.", {
+  server.tool("goodmem_memories_delete", "Delete a memory\n\nPermanently deletes a memory and its associated chunks. This operation cannot be undone and immediately removes the memory record from the database. IDEMPOTENCY: This operation is safe to retry - may return NOT_FOUND if the memory was already deleted or never existed. AUTHORIZATION: Requires DELETE_MEMORY on the requested memory; authority may be granted through DIRECT_MEMBERS_OF its containing space. Side effects include permanent removal of the memory record and all associated chunk data.", {
     id: external_exports.string().describe("The UUID of the memory to delete")
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
     await callApi("DELETE", `/v1/memories/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_memories_get", "Get a memory by ID\n\nRetrieves a single memory by its ID. PERMISSION CLARIFICATION: With READ_MEMORY_OWN permission, access is granted if you own the parent space OR if the parent space is public (public_read=true). With READ_MEMORY_ANY permission, you can access any memory regardless of ownership. This is a read-only operation with no side effects and is safe to retry. Returns NOT_FOUND if the memory or its parent space does not exist.", {
+  server.tool("goodmem_memories_get", "Get a memory by ID\n\nRetrieves a single memory by its ID. AUTHORIZATION: Requires READ_MEMORY on the requested memory; authority may be granted directly or through DIRECT_MEMBERS_OF its containing space. This is a read-only operation with no side effects and is safe to retry. Returns NOT_FOUND if the memory or its parent space does not exist.", {
     id: external_exports.string().describe("The UUID of the memory to retrieve"),
     include_content: external_exports.boolean().describe("Whether to include the original content in the response (defaults to false).").optional(),
     include_processing_history: external_exports.boolean().describe("Whether to include background job processing history in the response (defaults to false).").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22736,7 +23107,7 @@ function registerTools() {
     next_token: external_exports.string().describe("Opaque pagination token for the next page. URL-safe Base64 without padding; do not parse or construct it.").optional(),
     sort_by: external_exports.enum(["created_at", "updated_at", "content_type", "processing_status"]).describe("Field to sort by (e.g., 'created_at').").optional(),
     sort_order: external_exports.enum(["ASCENDING", "DESCENDING", "SORT_ORDER_UNSPECIFIED"]).describe("Sort direction (ASCENDING or DESCENDING).").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.space_id !== "string" || args.space_id === "") {
       throw new Error("'space_id' must be a non-empty string");
     }
@@ -22760,7 +23131,7 @@ function registerTools() {
     const result = await callApi("GET", `/v1/spaces/${encodeURIComponent(String(args.space_id))}/memories`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_pages", "List memory page images\n\nLists extracted page-image metadata for a memory with optional filters and pagination.", {
+  server.tool("goodmem_memories_pages", "List memory page images\n\nLists extracted page-image metadata for a memory with optional filters and pagination. Requires READ_MEMORY on the containing memory; authority may be granted through DIRECT_MEMBERS_OF its containing space.", {
     id: external_exports.string().describe("Memory UUID"),
     start_page_index: external_exports.number().int().describe("Optional lower bound for returned page indices, inclusive.").optional(),
     end_page_index: external_exports.number().int().describe("Optional upper bound for returned page indices, inclusive.").optional(),
@@ -22768,7 +23139,7 @@ function registerTools() {
     content_type: external_exports.string().describe("Optional rendition filter for page-image MIME type, such as image/png.").optional(),
     max_results: external_exports.number().int().describe("Maximum number of results per page.").optional(),
     next_token: external_exports.string().describe("Opaque pagination token for the next page. Do not parse or construct it.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22788,13 +23159,13 @@ function registerTools() {
     const result = await callApi("GET", `/v1/memories/${encodeURIComponent(String(args.id))}/pages`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_memories_pages_image", "Download memory page image content\n\nDownloads inline bytes for one page image. The page index is required. The optional dpi and content type query parameters act as rendition filters; if omitted, the server returns the unique rendition for that page or rejects ambiguous matches.", {
+  server.tool("goodmem_memories_pages_image", "Download memory page image content\n\nDownloads inline bytes for one page image. The page index is required. The optional dpi and content type query parameters act as rendition filters; if omitted, the server returns the unique rendition for that page or rejects ambiguous matches. Requires READ_MEMORY on the containing memory; authority may be granted through DIRECT_MEMBERS_OF its containing space.", {
     id: external_exports.string().describe("Memory UUID"),
     page_index: external_exports.number().int().describe("0-based page index"),
     dpi: external_exports.number().int().describe("Optional rendition filter. If omitted, the unique page-image rendition for the page is returned; if multiple renditions exist, specify dpi and/or content_type.").optional(),
     content_type: external_exports.string().describe("Optional rendition filter. MIME type of the desired page image, such as image/png.").optional(),
     max_inline_bytes: external_exports.number().int().positive().describe("Maximum bytes to deliver inline as a content block. Defaults to 8388608. Hard server ceiling: 67108864. If the payload exceeds this cap the tool errors with the actual size \u2014 retry with a larger value (up to the ceiling) to receive it.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -22855,12 +23226,8 @@ function registerTools() {
       name: external_exports.string().describe("Fully qualified factory class name of the post-processor to apply."),
       config: external_exports.record(external_exports.string(), external_exports.any()).describe("Configuration parameters for the post-processor. Fields depend on the selected processor; see the linked documentation for the built-in ChatPostProcessor schema.").optional()
     }).passthrough().describe("Optional post-processor configuration to transform retrieval results.").optional(),
-    logging: external_exports.object({
-      enabled: external_exports.boolean().describe("Opts this request in to durable server-side request logging. False or omitted does not opt out of admin policy logging.").optional(),
-      callerAttributes: external_exports.record(external_exports.string(), external_exports.any()).describe("Optional flat scalar attributes attached if this request is persisted by caller opt-in or admin policy logging. Supported value types are string, integer, floating-point, and boolean. At most 32 entries are accepted.").optional()
-    }).passthrough().describe("Optional durable request logging block for POST retrieve requests. Set logging.enabled=true to opt in, or supply flat scalar logging.callerAttributes to attach if caller opt-in or an admin policy logs the request.").optional(),
     timeout_sec: external_exports.number().int().describe("Maximum seconds to wait for the streaming response (default: 200).").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.message !== void 0)
       body["message"] = args.message;
@@ -22880,8 +23247,6 @@ function registerTools() {
       body["hnsw"] = args.hnsw;
     if (args.post_processor !== void 0)
       body["postProcessor"] = args.post_processor;
-    if (args.logging !== void 0)
-      body["logging"] = args.logging;
     const result = await callApiNdjson("POST", `/v1/memories:retrieve`, body, void 0, args.timeout_sec);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
@@ -22892,7 +23257,7 @@ function registerTools() {
     include_markdown: external_exports.boolean().describe("Include markdown rendering in the response").optional(),
     start_page: external_exports.number().int().describe("0-based inclusive start page").optional(),
     end_page: external_exports.number().int().describe("0-based inclusive end page").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.content !== void 0)
       body["content"] = args.content;
@@ -22909,14 +23274,14 @@ function registerTools() {
     const result = await callApi("POST", `/v1/ocr:document`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_ping_once", "Run a single ping probe\n\nRuns a single ping probe and returns the probe result.", {
+  server.tool("goodmem_ping_once", "Run a single ping probe\n\nRuns a single ping probe and returns the probe result. Requires both the target-specific PING operation and its corresponding EXECUTE operation: PING_EMBEDDER plus EXECUTE_EMBEDDER, PING_RERANKER plus EXECUTE_RERANKER, or PING_LLM plus EXECUTE_LLM.", {
     target_id: external_exports.string().describe("Target resource ID (UUID)"),
     target_type_hint: external_exports.enum(["TARGET_TYPE_UNSPECIFIED", "EMBEDDER", "RERANKER", "LLM"]).describe("Optional hint for the target resource type").optional(),
     payload_type: external_exports.enum(["PAYLOAD_TYPE_UNSPECIFIED", "TEXT", "JSON", "BINARY"]).describe("Desired payload type (defaults to provider-specific value)").optional(),
     payload: external_exports.string().describe("Explicit UTF-8 payload to send with the probe (mutually exclusive with payload_size_bytes)").optional(),
     payload_size_bytes: external_exports.number().int().describe("Synthetic payload size in bytes (mutually exclusive with payload)").optional(),
     timeout_ms: external_exports.number().int().describe("Per-probe timeout in milliseconds (0 uses server default)").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const _set = [args.payload !== void 0 && args.payload !== null, args.payload_size_bytes !== void 0 && args.payload_size_bytes !== null].filter(Boolean).length;
     if (_set > 1) {
       throw new Error("at most one of payload or payload_size_bytes may be set");
@@ -22937,7 +23302,7 @@ function registerTools() {
     const result = await callApi("POST", `/v1/ping:once`, body, void 0, (args.timeout_ms ?? 5e3) + 3e4);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_ping_stream", "Stream ping probe results\n\nOpens a streaming ping session and returns per-probe results plus a terminal summary.", {
+  server.tool("goodmem_ping_stream", "Stream ping probe results\n\nOpens a streaming ping session and returns per-probe results plus a terminal summary. Requires both the target-specific PING operation and its corresponding EXECUTE operation: PING_EMBEDDER plus EXECUTE_EMBEDDER, PING_RERANKER plus EXECUTE_RERANKER, or PING_LLM plus EXECUTE_LLM.", {
     target_id: external_exports.string().describe("Target resource ID (UUID)"),
     target_type_hint: external_exports.enum(["TARGET_TYPE_UNSPECIFIED", "EMBEDDER", "RERANKER", "LLM"]).describe("Optional hint for the target resource type").optional(),
     count: external_exports.number().int().describe("Number of probes to run (0 uses server default)").optional(),
@@ -22950,7 +23315,7 @@ function registerTools() {
     jitter: external_exports.boolean().describe("Add jitter to probe scheduling").optional(),
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Optional labels to attach to the ping session").optional(),
     timeout_sec: external_exports.number().int().describe("Maximum seconds to wait for the streaming response (default: 200).").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const _set = [args.payload !== void 0 && args.payload !== null, args.payload_size_bytes !== void 0 && args.payload_size_bytes !== null].filter(Boolean).length;
     if (_set > 1) {
       throw new Error("at most one of payload or payload_size_bytes may be set");
@@ -22981,7 +23346,7 @@ function registerTools() {
     const result = await callApiNdjson("POST", `/v1/ping:stream`, body, void 0, args.timeout_sec ?? Math.ceil(((args.count || 100) * (args.interval_ms || 1e3) + (args.timeout_ms || 5e3) + 6e4) / 1e3));
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_rerankers_create", "Create a new reranker\n\nCreates a new reranker configuration for ranking search results. Rerankers represent connections to different reranking API services (like TEI, OpenAI, etc.) and include all the necessary configuration to use them for result ranking. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another reranker exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner, allowing different users to have identical configurations. Credentials are hashed (SHA-256) for uniqueness while remaining encrypted. DEFAULTS: api_path defaults to '/v2/rerank' for Cohere and '/rerank' for other providers if omitted; supported_modalities defaults to [TEXT] if omitted. Requires CREATE_RERANKER_OWN permission (or CREATE_RERANKER_ANY for admin users). This operation is NOT idempotent - each request creates a new reranker record.", {
+  server.tool("goodmem_rerankers_create", "Create a new reranker\n\nCreates a new reranker configuration for ranking search results. Rerankers represent connections to different reranking API services (like TEI, OpenAI, etc.) and include all the necessary configuration to use them for result ranking. DUPLICATE DETECTION: Returns HTTP 409 Conflict (ALREADY_EXISTS) if another reranker exists with identical {owner_id, provider_type, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization. Uniqueness is enforced per-owner, allowing different users to have identical configurations. A SHA-256 credential fingerprint participates in uniqueness checking. DEFAULTS: api_path defaults to '/v2/rerank' for Cohere and '/rerank' for other providers if omitted; supported_modalities defaults to [TEXT] if omitted. OWNER DEFAULTS: Owner defaults to the authenticated principal unless owner_id is provided; CREATE_RERANKER is evaluated against the proposed reranker and owner. This operation is NOT idempotent - each request creates a new reranker record.", {
     display_name: external_exports.string().describe("User-facing name of the reranker"),
     description: external_exports.string().describe("Description of the reranker").optional(),
     provider_type: external_exports.enum(["OPENAI", "VLLM", "TEI", "LLAMA_CPP", "VOYAGE", "COHERE", "JINA"]).describe("Type of reranking provider (auto-inferred from model_identifier if omitted)").optional(),
@@ -23009,9 +23374,9 @@ function registerTools() {
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("User-defined labels for categorization").optional(),
     version: external_exports.string().describe("Version information").optional(),
     monitoring_endpoint: external_exports.string().describe("Monitoring endpoint URL").optional(),
-    owner_id: external_exports.string().describe("Optional owner ID. If not provided, derived from the authentication context. Requires CREATE_RERANKER_ANY permission if specified.").optional(),
+    owner_id: external_exports.string().describe("Optional owner principal UUID. If omitted, defaults to the authenticated principal. CREATE_RERANKER is evaluated against the proposed reranker and owner.").optional(),
     reranker_id: external_exports.string().describe("Optional client-provided UUID for idempotent creation. If not provided, server generates a new UUID. Returns ALREADY_EXISTS if ID is already in use.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const inferred = autoInferFromRegistry("rerankers", args);
     checkCredentialRequired(inferred);
     const body = {};
@@ -23044,29 +23409,33 @@ function registerTools() {
     const result = await callApi("POST", `/v1/rerankers`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_rerankers_delete", "Delete a reranker\n\nPermanently deletes a reranker configuration. This operation cannot be undone and immediately removes the reranker record from the database. SIDE EFFECTS: Invalidates any cached references to this reranker; does not affect historical usage data or audit logs. Requires DELETE_RERANKER_OWN permission for rerankers you own (or DELETE_RERANKER_ANY for admin users). This operation is safe to retry - may return NOT_FOUND if already deleted.", {
+  server.tool("goodmem_rerankers_delete", "Delete a reranker\n\nPermanently deletes a reranker configuration. This operation cannot be undone and immediately removes the reranker record from the database. SIDE EFFECTS: Invalidates any cached references to this reranker; does not affect historical usage data or audit logs. Requires DELETE_RERANKER on the requested reranker. This operation is safe to retry - may return NOT_FOUND if already deleted.", {
     id: external_exports.string().describe("The unique identifier of the reranker to delete")
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
     await callApi("DELETE", `/v1/rerankers/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_rerankers_get", "Get a reranker by ID\n\nRetrieves the details of a specific reranker configuration by its unique identifier. Response payloads include stored credentials, matching gRPC response semantics. Requires READ_RERANKER_OWN permission for rerankers you own (or READ_RERANKER_ANY for admin users). This is a read-only operation with no side effects and is safe to retry.", {
-    id: external_exports.string().describe("The unique identifier of the reranker to retrieve")
-  }, async (args) => {
+  server.tool("goodmem_rerankers_get", "Get a reranker by ID\n\nRetrieves the details of a specific reranker configuration by its unique identifier. Stored credentials are omitted unless include_credentials is true and the caller also has READ_RERANKER_CREDENTIALS. Requires READ_RERANKER on the requested reranker. The service distinguishes a missing reranker from an existing reranker the caller cannot read. This is a read-only operation with no side effects and is safe to retry.", {
+    id: external_exports.string().describe("The unique identifier of the reranker to retrieve"),
+    include_credentials: external_exports.boolean().describe("Whether to return stored credentials. Also accepts include_credentials. Requires READ_RERANKER_CREDENTIALS in addition to READ_RERANKER.").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
-    const result = await callApi("GET", `/v1/rerankers/${encodeURIComponent(String(args.id))}`, void 0);
+    const query = {};
+    if (args.include_credentials !== void 0)
+      query["includeCredentials"] = String(args.include_credentials);
+    const result = await callApi("GET", `/v1/rerankers/${encodeURIComponent(String(args.id))}`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_rerankers_list", "List rerankers\n\nRetrieves a list of reranker configurations accessible to the caller, with optional filtering. IMPORTANT: Pagination is NOT supported - all matching results are returned. Results are ordered by created_at descending. Responses include stored credentials, matching gRPC response semantics. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). PERMISSION-BASED FILTERING: With LIST_RERANKER_OWN permission, only your own rerankers are shown. With LIST_RERANKER_ANY permission, you can see all rerankers or filter by any owner_id. Specifying owner_id without LIST_RERANKER_ANY permission returns PERMISSION_DENIED.", {
-    owner_id: external_exports.string().describe("Filter rerankers by owner ID. With LIST_RERANKER_ANY permission, omitting this shows all accessible rerankers; providing it filters by that owner. With LIST_RERANKER_OWN permission, only your own rerankers are shown regardless of this parameter (PERMISSION_DENIED if set to another user).").optional(),
+  server.tool("goodmem_rerankers_list", "List rerankers\n\nRetrieves a list of reranker configurations accessible to the caller, with optional filtering. IMPORTANT: Pagination is NOT supported - all matching results are returned. Results are ordered by created_at descending. Stored credentials are never included in list responses. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production). AUTHORIZATION: Requires LIST_RERANKER on the GoodMem instance. Each returned reranker must also be visible through READ_RERANKER; unauthorized rerankers are filtered in PostgreSQL. The owner_id parameter filters that already-authorized result set and does not grant additional visibility.", {
+    owner_id: external_exports.string().describe("Filter the already-authorized result set by owner principal UUID. Omitting this parameter does not bypass per-reranker READ_RERANKER filtering.").optional(),
     provider_type: external_exports.enum(["OPENAI", "VLLM", "TEI", "LLAMA_CPP", "VOYAGE", "COHERE", "JINA"]).describe("Filter rerankers by provider type. Allowed values match the ProviderType schema.").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const query = {};
     if (args.owner_id !== void 0)
       query["ownerId"] = String(args.owner_id);
@@ -23079,7 +23448,7 @@ function registerTools() {
     const result = await callApi("GET", `/v1/rerankers`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_rerankers_update", "Update a reranker\n\nUpdates an existing reranker configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. IMMUTABLE FIELDS: providerType and ownerId cannot be changed after creation. SUPPORTED_MODALITIES UPDATE: If the array contains >=1 elements, it replaces the stored set; if empty or omitted, no change occurs and it does not count as an update by itself. Returns ALREADY_EXISTS if update would create duplicate with same {ownerId, providerType, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization (HTTP 409 Conflict / ALREADY_EXISTS). Requires UPDATE_RERANKER_OWN permission for rerankers you own (or UPDATE_RERANKER_ANY for admin users). This operation is idempotent.", {
+  server.tool("goodmem_rerankers_update", "Update a reranker\n\nUpdates an existing reranker configuration including display information, endpoint configuration, model parameters, credentials, and labels. All fields are optional - only specified fields will be updated. IMMUTABLE FIELDS: providerType and ownerId cannot be changed after creation. SUPPORTED_MODALITIES UPDATE: If the array contains >=1 elements, it replaces the stored set; if empty or omitted, no change occurs and it does not count as an update by itself. Returns ALREADY_EXISTS if update would create duplicate with same {ownerId, providerType, endpoint_url, api_path, model_identifier, credentialsFingerprint} after URL canonicalization (HTTP 409 Conflict / ALREADY_EXISTS). Requires UPDATE_RERANKER on the requested reranker. This operation is idempotent.", {
     id: external_exports.string().describe("The unique identifier of the reranker to update"),
     display_name: external_exports.string().describe("User-facing name of the reranker").optional(),
     description: external_exports.string().describe("Description of the reranker").optional(),
@@ -23103,12 +23472,12 @@ function registerTools() {
         quotaProjectId: external_exports.string().describe("Optional quota project used for billing").optional()
       }).passthrough().describe("Configuration when kind is CREDENTIAL_KIND_GCP_ADC").optional(),
       labels: external_exports.record(external_exports.string(), external_exports.string()).describe('Optional annotations to aid operators (e.g., "owner=vertex")').optional()
-    }).passthrough().describe("Structured credential payload describing how to authenticate with the provider. Omit to keep existing credentials.").optional(),
+    }).passthrough().describe("Replace stored credentials. Omit this field to preserve the current credentials; a present empty payload is invalid and never clears them.").optional(),
     replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Replace all existing labels with these (mutually exclusive with merge_labels)").optional(),
     merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Merge these labels with existing ones (mutually exclusive with replace_labels)").optional(),
     version: external_exports.string().describe("Version information").optional(),
     monitoring_endpoint: external_exports.string().describe("Monitoring endpoint URL").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -23142,15 +23511,112 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/rerankers/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_spaces_create", "Create a new Space\n\nCreates a new space with the provided name, labels, and embedder configuration. A space is a container for organizing related memories. OWNER DEFAULTS: Owner defaults to authenticated user unless owner_id is provided (requires CREATE_SPACE_ANY if differs). EMBEDDER REQUIREMENTS: At least one embedder configuration must be specified. DUPLICATE DETECTION: Returns ALREADY_EXISTS if another space exists with identical {owner_id, name} (case-sensitive). Requires CREATE_SPACE_OWN permission (or CREATE_SPACE_ANY for admin users). This operation is NOT idempotent.", {
+  server.tool("goodmem_service_identities_create", "Create a service identity\n\nCreates one production-workload identity owned by the authenticated human. No API key, role, grant, or authentication mapping is created implicitly.", {
+    service_identity_id: external_exports.string().describe("Optional client-provided UUID; generated by the server when omitted.").optional(),
+    display_name: external_exports.string().describe("Globally unique, nonblank operator-facing name."),
+    description: external_exports.string().describe("Optional operator description.").optional(),
+    labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Optional labels for organization and filtering. At most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional()
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
+    const body = {};
+    if (args.service_identity_id !== void 0)
+      body["serviceIdentityId"] = args.service_identity_id;
+    if (args.display_name !== void 0)
+      body["displayName"] = args.display_name;
+    if (args.description !== void 0)
+      body["description"] = args.description;
+    if (args.labels !== void 0)
+      body["labels"] = args.labels;
+    const result = await callApi("POST", `/v1/service-identities`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_service_identities_delete", "Delete a service identity\n\nPermanently soft-deletes the principal. Its stored credentials remain audit records but can no longer authenticate because their subject is deleted. Repeating an authorized delete succeeds without rewriting audit data.", {
+    id: external_exports.string().describe("Service-identity UUID")
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    await callApi("DELETE", `/v1/service-identities/${encodeURIComponent(String(args.id))}`, void 0);
+    return { content: [{ type: "text", text: "Deleted successfully." }] };
+  });
+  server.tool("goodmem_service_identities_get", "Get a service identity\n\nReturns a service identity after applying READ_SERVICE_IDENTITY authority. include_deleted permits an authorized caller to inspect a permanent tombstone; it does not grant additional authority.", {
+    id: external_exports.string().describe("Service-identity UUID"),
+    include_deleted: external_exports.boolean().describe("Permit an authorized read of a permanent tombstone").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const query = {};
+    if (args.include_deleted !== void 0)
+      query["includeDeleted"] = String(args.include_deleted);
+    const result = await callApi("GET", `/v1/service-identities/${encodeURIComponent(String(args.id))}`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_service_identities_list", "List service identities\n\nRequires LIST_SERVICE_IDENTITY on the GoodMem instance and READ_SERVICE_IDENTITY on each returned row. Owner and label filters, lifecycle filtering, authorization, and keyset pagination execute in PostgreSQL. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production).", {
+    owner_principal_id: external_exports.string().describe("Exact current administrative-owner principal UUID").optional(),
+    include_deleted: external_exports.boolean().describe("Include readable permanent tombstones").optional(),
+    max_results: external_exports.number().int().describe("Page size; defaults to 50 and must be between 1 and 1000").optional(),
+    next_token: external_exports.string().describe("Opaque continuation token").optional(),
+    label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    const query = {};
+    if (args.owner_principal_id !== void 0)
+      query["ownerPrincipalId"] = String(args.owner_principal_id);
+    if (args.include_deleted !== void 0)
+      query["includeDeleted"] = String(args.include_deleted);
+    if (args.max_results !== void 0)
+      query["maxResults"] = String(args.max_results);
+    if (args.next_token !== void 0)
+      query["nextToken"] = String(args.next_token);
+    if (args.label) {
+      for (const [k, v] of Object.entries(args.label))
+        query[`label[${k}]`] = v;
+    }
+    const result = await callApi("GET", `/v1/service-identities`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_service_identities_transfer_ownership", "Transfer service-identity ownership\n\nTransfers administrative ownership to another active principal. A service identity cannot own itself. The service identity's subject, immutable creator, credentials, grants, and roles are unchanged.", {
+    id: external_exports.string().describe("Service-identity UUID"),
+    new_owner_id: external_exports.string().describe("Existing principal UUID that will become the new owner.")
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const body = {};
+    if (args.new_owner_id !== void 0)
+      body["newOwnerId"] = args.new_owner_id;
+    const result = await callApi("POST", `/v1/service-identities/${encodeURIComponent(String(args.id))}:transferOwnership`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_service_identities_update", "Update a service identity\n\nUpdates only fields present in the request. Empty description clears that optional field. Ownership changes use the dedicated transfer endpoint.", {
+    id: external_exports.string().describe("Service-identity UUID"),
+    display_name: external_exports.string().describe("Replacement display name. A present blank value is invalid.").optional(),
+    description: external_exports.string().describe("Replacement description. An empty string clears the description.").optional(),
+    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Complete replacement label map; an empty map clears all labels and is mutually exclusive with merge_labels. At most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional(),
+    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Labels to upsert; must contain at least one entry and is mutually exclusive with replace_labels. The final stored map may contain at most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional()
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const body = {};
+    if (args.display_name !== void 0)
+      body["displayName"] = args.display_name;
+    if (args.description !== void 0)
+      body["description"] = args.description;
+    if (args.replace_labels !== void 0)
+      body["replaceLabels"] = args.replace_labels;
+    if (args.merge_labels !== void 0)
+      body["mergeLabels"] = args.merge_labels;
+    const result = await callApi("PUT", `/v1/service-identities/${encodeURIComponent(String(args.id))}`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_spaces_create", "Create a new Space\n\nCreates a new space with the provided name, labels, and embedder configuration. A space is a container for organizing related memories. OWNER DEFAULTS: Owner defaults to the authenticated principal unless owner_id is provided; CREATE_SPACE is evaluated against the proposed space and owner. EMBEDDER REQUIREMENTS: At least one embedder configuration must be specified. Every referenced embedder must exist, and the caller must have EXECUTE_EMBEDDER on each one. DUPLICATE DETECTION: Returns ALREADY_EXISTS if another space exists with identical {owner_id, name} (case-sensitive). This operation is NOT idempotent.", {
     name: external_exports.string().describe("The desired name for the space. Must be unique within the user's scope."),
     labels: external_exports.record(external_exports.string(), external_exports.string()).describe("A set of key-value pairs to categorize or tag the space. Used for filtering and organizational purposes.").optional(),
     space_embedders: external_exports.array(external_exports.object({
       embedderId: external_exports.string().describe("The UUID for the embedder to associate with the space."),
       defaultRetrievalWeight: external_exports.number().describe("Relative weight for this embedder used by default during retrieval. If omitted, defaults to 1.0; values need not sum to 1 and can be overridden per request.").optional()
     }).passthrough()).describe("List of embedder configurations to associate with this space. At least one embedder configuration is required. Each specifies an embedder ID and a relative default retrieval weight used when no per-request overrides are provided."),
-    public_read: external_exports.boolean().describe("Indicates if the space and its memories can be read by unauthenticated users or users other than the owner. Defaults to false.").optional(),
-    owner_id: external_exports.string().describe("Optional owner ID. If not provided, derived from the authentication context. Requires CREATE_SPACE_ANY permission if specified.").optional(),
+    owner_id: external_exports.string().describe("Optional owner principal UUID. If omitted, defaults to the authenticated principal. CREATE_SPACE is evaluated against the proposed space and owner.").optional(),
     default_chunking_config: external_exports.object({
       none: external_exports.any().describe("No chunking strategy - preserve original content as single unit").optional(),
       recursive: external_exports.object({
@@ -23169,7 +23635,7 @@ function registerTools() {
       }).passthrough().describe("Sentence-based chunking strategy with language detection").optional()
     }).passthrough().describe("Default chunking strategy for memories in this space"),
     space_id: external_exports.string().describe("Optional client-provided UUID for idempotent creation. If not provided, server generates a new UUID. Returns ALREADY_EXISTS if ID is already in use.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
     const body = {};
     if (args.name !== void 0)
       body["name"] = args.name;
@@ -23177,8 +23643,6 @@ function registerTools() {
       body["labels"] = args.labels;
     if (args.space_embedders !== void 0)
       body["spaceEmbedders"] = args.space_embedders;
-    if (args.public_read !== void 0)
-      body["publicRead"] = args.public_read;
     if (args.owner_id !== void 0)
       body["ownerId"] = args.owner_id;
     if (args.default_chunking_config !== void 0)
@@ -23188,18 +23652,18 @@ function registerTools() {
     const result = await callApi("POST", `/v1/spaces`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_spaces_delete", "Delete a space\n\nPermanently deletes a space and all associated content. This operation cannot be undone. CASCADE DELETION: Removes the space record and cascades deletion to associated memories, chunks, and embedder associations. Requires DELETE_SPACE_OWN permission for spaces you own (or DELETE_SPACE_ANY for admin users). This operation is safe to retry - may return NOT_FOUND if already deleted.", {
+  server.tool("goodmem_spaces_delete", "Delete a space\n\nPermanently deletes a space and all associated content. This operation cannot be undone. CASCADE DELETION: Removes the space record and cascades deletion to associated memories, chunks, and embedder associations. Requires DELETE_SPACE on the requested space. This operation is safe to retry and may return NOT_FOUND if the space was already deleted.", {
     id: external_exports.string().describe("The unique identifier of the space to delete")
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
     await callApi("DELETE", `/v1/spaces/${encodeURIComponent(String(args.id))}`, void 0);
     return { content: [{ type: "text", text: "Deleted successfully." }] };
   });
-  server.tool("goodmem_spaces_get", "Get a space by ID\n\nRetrieves a specific space by its unique identifier. Returns the complete space information, including name, labels, embedder configuration, and metadata. PUBLIC SPACE ACCESS: When public_read=true, any authenticated user can retrieve the space metadata, bypassing ownership checks. Otherwise, requires ownership or DISPLAY_SPACE_ANY permission. Requires DISPLAY_SPACE_OWN permission for owned spaces (or DISPLAY_SPACE_ANY for admin users to view any space). This is a read-only operation safe to retry.", {
+  server.tool("goodmem_spaces_get", "Get a space by ID\n\nRetrieves a specific space by its unique identifier. Returns the complete space information, including name, labels, embedder configuration, and metadata. Requires READ_SPACE on the requested space. The service distinguishes a missing space from an existing space the caller cannot read. This is a read-only operation safe to retry.", {
     id: external_exports.string().describe("The unique identifier of the space to retrieve")
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -23207,14 +23671,14 @@ function registerTools() {
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
   server.tool("goodmem_spaces_list", "List spaces accessible to the caller, with optional filtering by owner, labels, and name. Results are paginated; pass the response's `next_token` back as a query parameter to fetch subsequent pages.", {
-    owner_id: external_exports.string().describe("Filter spaces by owner ID. With LIST_SPACE_ANY permission and owner_id omitted, returns all visible spaces. Otherwise returns caller-owned spaces only. Specifying owner_id without LIST_SPACE_ANY returns PERMISSION_DENIED.").optional(),
+    owner_id: external_exports.string().describe("Filter the already-authorized result set by owner principal UUID. Omitting this parameter does not bypass per-space READ_SPACE filtering.").optional(),
     name_filter: external_exports.string().describe("Filter spaces by name using glob pattern matching").optional(),
     max_results: external_exports.number().int().describe("Maximum number of results to return in a single page (defaults to 50, clamped to [1, 1000])").optional(),
     next_token: external_exports.string().describe("Pagination token for retrieving the next set of results").optional(),
     sort_by: external_exports.enum(["created_time", "updated_time", "name"]).describe("Field to sort by: 'created_time', 'updated_time', or 'name' (default: 'created_time'). Unsupported values return INVALID_ARGUMENT.").optional(),
     sort_order: external_exports.enum(["ASCENDING", "DESCENDING", "SORT_ORDER_UNSPECIFIED"]).describe("Sort order (ASCENDING or DESCENDING, default: DESCENDING)").optional(),
     label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const query = {};
     if (args.owner_id !== void 0)
       query["ownerId"] = String(args.owner_id);
@@ -23235,13 +23699,25 @@ function registerTools() {
     const result = await callApi("GET", `/v1/spaces`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_spaces_update", "Update a space\n\nUpdates an existing space with new values for the specified fields. Only name, public_read, and labels can be updated. Fields not included in the request remain unchanged. IMMUTABLE FIELDS: space_embedders, default_chunking_config, and ownerId cannot be modified after creation. NAME UNIQUENESS: Name must be unique per owner - returns ALREADY_EXISTS if name conflicts with existing space. Requires UPDATE_SPACE_OWN permission for spaces you own (or UPDATE_SPACE_ANY for admin users). This operation is idempotent.", {
+  server.tool("goodmem_spaces_transfer_ownership", "Transfer ownership of a space\n\nTransfers an existing space to another active human or service principal. The current space owner, the GoodMem instance owner, or an instance administrator may transfer it; a space-scoped administrator cannot. Only owner and update-audit fields change. Memories, embedder associations, grants, and role assignments remain unchanged. This operation is not idempotent under response semantics: after an unknown outcome, read the space before retrying.", {
+    id: external_exports.string().describe("UUID of the existing space to transfer"),
+    new_owner_id: external_exports.string().describe("Existing principal UUID that will become the new owner.")
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const body = {};
+    if (args.new_owner_id !== void 0)
+      body["newOwnerId"] = args.new_owner_id;
+    const result = await callApi("POST", `/v1/spaces/${encodeURIComponent(String(args.id))}:transferOwnership`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_spaces_update", "Update a space\n\nUpdates an existing space with new values for the specified fields. Only name and labels can be updated. Fields not included in the request remain unchanged. IMMUTABLE FIELDS: space_embedders, default_chunking_config, and ownerId cannot be modified after creation. NAME UNIQUENESS: Name must be unique per owner - returns ALREADY_EXISTS if name conflicts with an existing space. Requires UPDATE_SPACE on the requested space. This operation is idempotent.", {
     id: external_exports.string().describe("The unique identifier of the space to update"),
     name: external_exports.string().describe("The new name for the space.").optional(),
-    public_read: external_exports.boolean().describe("Whether the space is publicly readable by all users.").optional(),
     replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Labels to replace all existing labels. Mutually exclusive with merge_labels.").optional(),
     merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Labels to merge with existing labels. Mutually exclusive with replace_labels.").optional()
-  }, async (args) => {
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
     if (typeof args.id !== "string" || args.id === "") {
       throw new Error("'id' must be a non-empty string");
     }
@@ -23252,8 +23728,6 @@ function registerTools() {
     const body = {};
     if (args.name !== void 0)
       body["name"] = args.name;
-    if (args.public_read !== void 0)
-      body["publicRead"] = args.public_read;
     if (args.replace_labels !== void 0)
       body["replaceLabels"] = args.replace_labels;
     if (args.merge_labels !== void 0)
@@ -23261,18 +23735,80 @@ function registerTools() {
     const result = await callApi("PUT", `/v1/spaces/${encodeURIComponent(String(args.id))}`, body);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_system_info", "Retrieve server build metadata\n\nReturns the server's advertised semantic version, git metadata, build timestamp, and optional capability flags. The endpoint is intentionally unauthenticated so bootstrap tooling can call it before API keys exist.", {}, async (args) => {
+  server.tool("goodmem_system_info", "Retrieve server build metadata\n\nReturns the server's advertised semantic version, git metadata, build timestamp, and optional capability flags. The endpoint is intentionally unauthenticated so bootstrap tooling can call it before API keys exist.", {}, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const result = await callApi("GET", `/v1/system/info`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_system_init", "Initialize the system\n\nInitializes the system by creating a root user and API key. This endpoint should only be called once during first-time setup. If the system is already initialized, the endpoint will return a success response without creating new credentials.", {}, async (args) => {
+  server.tool("goodmem_system_init", "Initialize the system\n\nInitializes the system by creating a root user and API key. This endpoint should only be called once during first-time setup. If the system is already initialized, the endpoint will return a success response without creating new credentials.", {}, { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false }, async (args) => {
     const result = await callApi("POST", `/v1/system/init`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
+  server.tool("goodmem_user_enrollments_complete", "Complete human-user enrollment\n\nExchanges a one-time enrollment credential for the human's initial self-owned API key. This endpoint does not use ordinary API-key authentication. Omit both optional key fields for server generation; a fresh response discloses the raw key exactly once and cannot be safely retried after an ambiguous outcome. Supply and retain both fields for client mode, where only an exact tuple retry is safe and raw material is never echoed. Status precedence is request-shape errors (400), then the same generic authentication failure for every nonblank unusable enrollment (401); key conflicts or concurrent lifecycle winners return 409, rate limits return 429, and unexpected failures return 500.", {
+    enrollment_token: external_exports.string().describe("Required one-time enrollment credential. Never log or persist it."),
+    api_key_id: external_exports.string().describe("Optional client-generated API-key UUID retained for exact retries. Must be supplied together with raw_api_key, or both fields must be omitted.").optional(),
+    raw_api_key: external_exports.string().describe("Optional canonical client-generated API key. Must be supplied together with api_key_id, never logged, and retained for exact retries; omit both fields for server generation.").optional()
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false }, async (args) => {
+    const body = {};
+    if (args.enrollment_token !== void 0)
+      body["enrollmentToken"] = args.enrollment_token;
+    if (args.api_key_id !== void 0)
+      body["apiKeyId"] = args.api_key_id;
+    if (args.raw_api_key !== void 0)
+      body["rawApiKey"] = args.raw_api_key;
+    const result = await callApi("POST", `/v1/user-enrollments:complete`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_users_create", "Create a human user\n\nCreates one dormant human user after requiring instance-wide CREATE_USER authority. Creation does not issue a credential or create a role, grant, or authentication mapping.", {
+    user_id: external_exports.string().describe("Optional client-provided user UUID; generated by the server when omitted.").optional(),
+    email: external_exports.string().describe("Unique, nonempty email address."),
+    username: external_exports.string().describe("Optional unique username.").optional(),
+    display_name: external_exports.string().describe("Optional human-facing display name.").optional(),
+    labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Optional labels for organization and filtering. At most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional()
+  }, { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }, async (args) => {
+    const body = {};
+    if (args.user_id !== void 0)
+      body["userId"] = args.user_id;
+    if (args.email !== void 0)
+      body["email"] = args.email;
+    if (args.username !== void 0)
+      body["username"] = args.username;
+    if (args.display_name !== void 0)
+      body["displayName"] = args.display_name;
+    if (args.labels !== void 0)
+      body["labels"] = args.labels;
+    const result = await callApi("POST", `/v1/users`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_users_create_enrollment", "Create a human-user enrollment\n\nCreates a short-lived, one-time enrollment credential for an existing dormant human. Requires MANAGE_USER_ENROLLMENT with ANY or EXACT authority on the target user. The raw credential is returned only once. rotate_existing atomically revokes and replaces a live enrollment; an expired enrollment is replaced automatically.", {
+    user_id: external_exports.string().describe("Human-user UUID"),
+    enrollment_id: external_exports.string().describe("Optional client-provided enrollment UUID; generated when omitted.").optional(),
+    rotate_existing: external_exports.boolean().describe("Whether an existing live enrollment may be revoked and atomically replaced.").optional()
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.user_id !== "string" || args.user_id === "") {
+      throw new Error("'user_id' must be a non-empty string");
+    }
+    const body = {};
+    if (args.enrollment_id !== void 0)
+      body["enrollmentId"] = args.enrollment_id;
+    if (args.rotate_existing !== void 0)
+      body["rotateExisting"] = args.rotate_existing;
+    const result = await callApi("POST", `/v1/users/${encodeURIComponent(String(args.user_id))}/enrollments`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_users_delete", "Delete a human user\n\nPermanently soft-deletes the user and invalidates credentials acting for that subject. The GoodMem instance owner cannot be deleted; transfer ownership first. Repeating an authorized delete succeeds without rewriting audit data.", {
+    id: external_exports.string().describe("User UUID")
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    await callApi("DELETE", `/v1/users/${encodeURIComponent(String(args.id))}`, void 0);
+    return { content: [{ type: "text", text: "Deleted successfully." }] };
+  });
   server.tool("goodmem_users_get", "Retrieves a user by ID or email address. Exactly one of `id` and `email` must be provided. For getting your own profile, use the `goodmem_users_me` tool.", {
-    id: external_exports.string().describe("The UUID of the user to retrieve").optional(),
-    email: external_exports.string().describe("The email address of the user to retrieve").optional()
-  }, async (args) => {
+    id: external_exports.string().describe("User UUID").optional(),
+    email: external_exports.string().describe("URL-encoded email address").optional(),
+    include_deleted: external_exports.boolean().describe("Permit an authorized read of a permanent tombstone").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const _hasId = typeof args.id === "string" && args.id !== "";
     const _hasEmail = typeof args.email === "string" && args.email !== "";
     if (_hasId && _hasEmail)
@@ -23280,13 +23816,119 @@ function registerTools() {
     if (!_hasId && !_hasEmail)
       throw new Error("Exactly one of 'id', 'email' must be provided (non-empty).");
     const url = _hasEmail ? `/v1/users/email/${encodeURIComponent(String(args.email))}` : `/v1/users/${encodeURIComponent(String(args.id))}`;
-    const result = await callApi("GET", url, void 0);
+    const query = {};
+    if (args.include_deleted !== void 0)
+      query["includeDeleted"] = String(args.include_deleted);
+    const result = await callApi("GET", url, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_users_get_by_username", "Get user by username\n\nReturns a user selected by exact username after applying READ_USER authority. include_deleted permits an authorized caller to inspect a permanent tombstone; it does not grant additional authority. Missing and unauthorized matches both return 404 so this guessable identifier cannot reveal whether a user exists.", {
+    username: external_exports.string().describe("Exact username"),
+    include_deleted: external_exports.boolean().describe("Permit an authorized read of a permanent tombstone").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.username !== "string" || args.username === "") {
+      throw new Error("'username' must be a non-empty string");
+    }
+    const query = {};
+    if (args.include_deleted !== void 0)
+      query["includeDeleted"] = String(args.include_deleted);
+    const result = await callApi("GET", `/v1/users/username/${encodeURIComponent(String(args.username))}`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_users_get_enrollment", "Get a human-user enrollment\n\nReturns non-secret metadata for one current or historical enrollment. The target user is resolved before the enrollment, and MANAGE_USER_ENROLLMENT with ANY or EXACT authority on that user is required. Raw enrollment tokens are never returned.", {
+    user_id: external_exports.string().describe("Human-user UUID"),
+    enrollment_id: external_exports.string().describe("Enrollment UUID")
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.user_id !== "string" || args.user_id === "") {
+      throw new Error("'user_id' must be a non-empty string");
+    }
+    if (typeof args.enrollment_id !== "string" || args.enrollment_id === "") {
+      throw new Error("'enrollment_id' must be a non-empty string");
+    }
+    const result = await callApi("GET", `/v1/users/${encodeURIComponent(String(args.user_id))}/enrollments/${encodeURIComponent(String(args.enrollment_id))}`, void 0);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_users_list", "List human users\n\nRequires LIST_USER on the GoodMem instance and READ_USER on each returned row. Authorization, label filtering, lifecycle filtering, and keyset pagination run in PostgreSQL. include_deleted expands the lifecycle view but grants no access. include_enrollment_summary requests non-secret bootstrap posture only on active rows where MANAGE_USER_ENROLLMENT is independently authorized. LABEL FILTERS: Label filters accept either label.<key>=<value> or label[key]=value (for example, label.environment=production or label[environment]=production).", {
+    include_deleted: external_exports.boolean().describe("Include readable permanent tombstones").optional(),
+    include_enrollment_summary: external_exports.boolean().describe("Request non-secret enrollment posture on active rows where the caller also has MANAGE_USER_ENROLLMENT").optional(),
+    max_results: external_exports.number().int().describe("Page size; defaults to 50 and must be between 1 and 1000").optional(),
+    next_token: external_exports.string().describe("Opaque continuation token").optional(),
+    label: external_exports.record(external_exports.string(), external_exports.string()).describe("Filter by label. Each key-value pair is sent as label[key]=value query parameter.").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    const query = {};
+    if (args.include_deleted !== void 0)
+      query["includeDeleted"] = String(args.include_deleted);
+    if (args.include_enrollment_summary !== void 0)
+      query["includeEnrollmentSummary"] = String(args.include_enrollment_summary);
+    if (args.max_results !== void 0)
+      query["maxResults"] = String(args.max_results);
+    if (args.next_token !== void 0)
+      query["nextToken"] = String(args.next_token);
+    if (args.label) {
+      for (const [k, v] of Object.entries(args.label))
+        query[`label[${k}]`] = v;
+    }
+    const result = await callApi("GET", `/v1/users`, void 0, query);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  server.tool("goodmem_users_list_enrollments", "List a human user's enrollments\n\nReturns one newest-first page containing pending, expired, consumed, and revoked enrollment metadata. MANAGE_USER_ENROLLMENT with ANY or EXACT authority on the target user is required. The page never contains raw credentials.", {
+    user_id: external_exports.string().describe("Human-user UUID"),
+    max_results: external_exports.number().int().describe("Page size; defaults to 50 and must be between 1 and 1000").optional(),
+    next_token: external_exports.string().describe("Opaque continuation token").optional()
+  }, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
+    if (typeof args.user_id !== "string" || args.user_id === "") {
+      throw new Error("'user_id' must be a non-empty string");
+    }
+    const query = {};
+    if (args.max_results !== void 0)
+      query["maxResults"] = String(args.max_results);
+    if (args.next_token !== void 0)
+      query["nextToken"] = String(args.next_token);
+    const result = await callApi("GET", `/v1/users/${encodeURIComponent(String(args.user_id))}/enrollments`, void 0, query);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
-  server.tool("goodmem_users_me", "Get current user profile\n\nRetrieves the authenticated user's profile information including email, display name, and creation time. This endpoint does not require any parameters as it automatically returns the caller's information.", {}, async (args) => {
+  server.tool("goodmem_users_me", "Get current user profile\n\nReturns the human-user profile associated with the authenticated principal. Service principals do not have a human-user profile.", {}, { readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (args) => {
     const result = await callApi("GET", `/v1/users/me`, void 0);
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   });
+  server.tool("goodmem_users_revoke_enrollment", "Revoke a human-user enrollment\n\nPermanently revokes one outstanding enrollment after requiring MANAGE_USER_ENROLLMENT on its target user. Repeating an authorized revocation succeeds without replacing its original audit provenance. Consumed enrollments cannot be revoked.", {
+    user_id: external_exports.string().describe("Human-user UUID"),
+    enrollment_id: external_exports.string().describe("Enrollment UUID")
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
+    if (typeof args.user_id !== "string" || args.user_id === "") {
+      throw new Error("'user_id' must be a non-empty string");
+    }
+    if (typeof args.enrollment_id !== "string" || args.enrollment_id === "") {
+      throw new Error("'enrollment_id' must be a non-empty string");
+    }
+    await callApi("DELETE", `/v1/users/${encodeURIComponent(String(args.user_id))}/enrollments/${encodeURIComponent(String(args.enrollment_id))}`, void 0);
+    return { content: [{ type: "text", text: "Deleted successfully." }] };
+  });
+  server.tool("goodmem_users_update", "Update a human user\n\nUpdates only fields present in the request. Empty username or display_name values clear those optional fields. Updating a deleted user fails with 412.", {
+    id: external_exports.string().describe("User UUID"),
+    email: external_exports.string().describe("Replacement email. A present empty value is invalid.").optional(),
+    username: external_exports.string().describe("Replacement username. An empty string clears the username.").optional(),
+    display_name: external_exports.string().describe("Replacement display name. An empty string clears the display name.").optional(),
+    replace_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Complete replacement label map; an empty map clears all labels and is mutually exclusive with merge_labels. At most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional(),
+    merge_labels: external_exports.record(external_exports.string(), external_exports.string()).describe("Labels to upsert; must contain at least one entry and is mutually exclusive with replace_labels. The final stored map may contain at most 20 entries; keys and values contain at most 255 characters; keys use [a-z0-9._-].").optional()
+  }, { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }, async (args) => {
+    if (typeof args.id !== "string" || args.id === "") {
+      throw new Error("'id' must be a non-empty string");
+    }
+    const body = {};
+    if (args.email !== void 0)
+      body["email"] = args.email;
+    if (args.username !== void 0)
+      body["username"] = args.username;
+    if (args.display_name !== void 0)
+      body["displayName"] = args.display_name;
+    if (args.replace_labels !== void 0)
+      body["replaceLabels"] = args.replace_labels;
+    if (args.merge_labels !== void 0)
+      body["mergeLabels"] = args.merge_labels;
+    const result = await callApi("PUT", `/v1/users/${encodeURIComponent(String(args.id))}`, body);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
 }
 registerTools();
 async function healthCheck() {