@vectros-ai/cli 0.14.0 → 0.16.0

package/dist/cli.mjs

@@ -1680,6 +1680,7 @@ __export(api_exports, {
   TooManyRequestsError: () => TooManyRequestsError,
   TruncationWarningEvent: () => TruncationWarningEvent,
   UnauthorizedError: () => UnauthorizedError,
+  UserExistsResponse: () => UserExistsResponse,
   UserRequest: () => UserRequest,
   UserResponse: () => UserResponse,
   auth: () => auth_exports,
@@ -2356,6 +2357,14 @@ var TruncationWarningEvent;
     ContextWindowBudget: "context_window_budget"
   };
 })(TruncationWarningEvent || (TruncationWarningEvent = {}));
+var UserExistsResponse;
+((UserExistsResponse2) => {
+  UserExistsResponse2.Status = {
+    Active: "ACTIVE",
+    Suspended: "SUSPENDED",
+    Pending: "PENDING"
+  };
+})(UserExistsResponse || (UserExistsResponse = {}));
 var UserRequest;
 ((UserRequest2) => {
   UserRequest2.Status = {
@@ -4099,7 +4108,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/admin/keys/scoped");
   }
   /**
-   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope.
+   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. A root API key (`sk_`) is exempt from both bounds.
    *
    * @param {Vectros.CreateScopedKeyRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4431,7 +4440,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope, and applies the same `identityOverrides` bounds the update endpoint documents — a scoped credential may not repoint or clear an identity value it does not itself hold). You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
+   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope, and applies the same `identityOverrides` bounds the update endpoint documents — a scoped credential may not repoint or clear an identity value it does not itself hold). The `principalId` must name a principal that already exists: a `usr_` principal must be a live user in your tenant, so create the user before granting it a profile. A `usr_` id that names no such user is rejected, and no profile is created. `key_` principals are not checked this way. You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
    *
    * @param {Vectros.CreateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4849,11 +4858,12 @@ var AuthClient = class {
     );
   }
   /**
-   * Updates an access profile. This is a partial update: any field you omit (or send as null) keeps its existing value. A profile must reference either inline `scopes` or a `roleId`, never both — so setting `scopes` clears any `roleId`, and setting `roleId` clears any inline `scopes`. The `contextId` and `principalId` are immutable. Status changes (for example active to suspended) take effect within about five minutes. If you use a scoped credential, the profile's effective scopes may not exceed your own, and its `identityOverrides` are bounded twice: you may only set a value your own identity holds, and you may only change or clear a value the profile already holds if that value is yours as well. Repointing or clearing another principal's established identity therefore returns 403. A root API key (`sk_`) is exempt. Requires the `profiles:u` scope.
+   * Updates an access profile. This is a partial update: any field you omit (or send as null) keeps its existing value. A profile must reference either inline `scopes` or a `roleId`, never both — so setting `scopes` clears any `roleId`, and setting `roleId` clears any inline `scopes`. The `contextId` and `principalId` are immutable. Status changes (for example active to suspended) take effect within about five minutes. If you use a scoped credential, the profile's effective scopes may not exceed your own, and its `identityOverrides` are bounded twice: you may only set a value your own identity holds, and you may only change or clear a value the profile already holds if that value is yours as well. Repointing or clearing another principal's established identity therefore returns 403. A root API key (`sk_`) is exempt. If you set `roleId`, it must reference a role that already exists in this context. Requires the `profiles:u` scope.
    *
    * @param {Vectros.UpdateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
@@ -4900,6 +4910,8 @@ var AuthClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
@@ -5529,7 +5541,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access.
+   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access. **A token confined to a single app context sees only that context's usage**: totals, the environment split, and the `contexts` breakdown narrow to it, and the environment your context is not bound to is omitted (`null`), not zeroed. Only a token with cross-context reach sees your full account-wide totals. Two exceptions to the narrowing, since they have no per-context breakdown to narrow to: `reads.calls.used`/`reads.dataOut.bytes` (metered per account, not per context) read as `0` for a confined token rather than a narrowed figure — the corresponding overage-credit charge fields narrow correctly; and `credits.limit` stays your whole plan's ceiling, so `credits.remaining` may overstate the account's true remaining room.
    *
    * @param {Vectros.GetUsageRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5591,6 +5603,257 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/usage");
   }
+  /**
+   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key sees every context.
+   *
+   * @param {Vectros.GetIssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   *
+   * @example
+   *     await client.auth.getIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  getIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getIssuer(request, requestOptions));
+  }
+  async __getIssuer(request, requestOptions) {
+    const { issuerId } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
+  }
+  /**
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. Deactivate the affected users first if you intend to cut off their access, or register a replacement issuer before removing this one. An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
+   *
+   * @param {Vectros.DeleteIssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.deleteIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  deleteIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteIssuer(request, requestOptions));
+  }
+  async __deleteIssuer(request, requestOptions) {
+    const { issuerId } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "DELETE",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: void 0, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "DELETE",
+      "/v1/auth/issuers/{issuerId}"
+    );
+  }
+  /**
+   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only the issuers registered in that context; a root API key sees every context. Returns a `{data, nextCursor}` envelope.
+   *
+   * @param {Vectros.ListIssuersRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   *
+   * @example
+   *     await client.auth.listIssuers()
+   */
+  listIssuers(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listIssuers(request, requestOptions));
+  }
+  async __listIssuers(request = {}, requestOptions) {
+    const { startFrom, limit } = request;
+    const _queryParams = {
+      startFrom,
+      limit
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/issuers"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
+  }
+  /**
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`.
+   *
+   * @param {Vectros.IssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.registerIssuer({
+   *         issuerId: "auth0-prod",
+   *         issuer: "https://your-tenant.us.auth0.com/",
+   *         jwksUri: "https://your-tenant.us.auth0.com/.well-known/jwks.json",
+   *         audience: "https://api.your-app.example.com",
+   *         contextId: "casework"
+   *     })
+   */
+  registerIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__registerIssuer(request, requestOptions));
+  }
+  async __registerIssuer(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/issuers"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/issuers");
+  }
   /**
    * Returns the identity bound to your credential — your account, principal type, key id, and scope details — so you can confirm who you are authenticated as and that the credential is valid. MCP clients use this to render "signed in as ..." in a chat UI without a separate identity endpoint.
    *
@@ -5636,7 +5899,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/ping");
   }
   /**
-   * Returns the access profiles for the given principal across all of your contexts. Use this to answer questions like "which apps does this user have access to?" — for example, to build a member-access summary. Results are confined to your account. Requires the `profiles:r` scope.
+   * Returns the access profiles for the given principal. Looking up your OWN principal — or holding the `context-directory-read` capability — returns the profiles across ALL of your contexts, letting you answer questions like "which apps does this user have access to?". A context-bound credential looking up a DIFFERENT principal instead sees only that principal's profile in your credential's own context (at most one result), never across contexts it has no authority over. Results are always confined to your account. Requires the `profiles:r` scope.
    *
    * @param {Vectros.ListProfilesForPrincipalRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5914,40 +6177,34 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/invite/resend");
   }
-};
-var ComplianceClient = class {
-  constructor(options) {
-    this._options = normalizeClientOptionsWithAuth(options);
-  }
   /**
-   * Submits a right-to-erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure removes exactly the data the subject solely owns across the declared contexts, plus the subject's identity and lookup rows. It never touches another account's data and never cascades into another subject's data. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
+   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. If your issuer is registered against more than one app context (each via its own audience), `context_id` selects which one to target; omit it when your token's `aud` claim matches only one registered context — the common case, unaffected by this field. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
    *
-   * @param {Vectros.ErasureRequest} request
-   * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
+   * @param {Vectros.TokenExchangeRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.UnauthorizedError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
-   *     await client.compliance.createErasureRequest({
-   *         subjectType: "user"
+   *     await client.auth.exchangeToken({
+   *         grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+   *         subject_token: "subject_token",
+   *         subject_token_type: "urn:ietf:params:oauth:token-type:jwt"
    *     })
    */
-  createErasureRequest(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__createErasureRequest(request, requestOptions));
+  exchangeToken(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__exchangeToken(request, requestOptions));
   }
-  async __createErasureRequest(request, requestOptions) {
-    const _authRequest = await this._options.authProvider.getAuthRequest();
-    const _headers = mergeHeaders(
-      _authRequest.headers,
-      this._options?.headers,
-      requestOptions?.headers
-    );
+  async __exchangeToken(request, requestOptions) {
+    const _headers = mergeHeaders(this._options?.headers, requestOptions?.headers);
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/erasure-requests"
+        "v1/auth/token/exchange"
       ),
       method: "POST",
       headers: _headers,
@@ -5966,12 +6223,16 @@ var ComplianceClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 401:
+          throw new UnauthorizedError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -5980,10 +6241,78 @@ var ComplianceClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/erasure-requests");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token/exchange");
+  }
+};
+var ComplianceClient = class {
+  constructor(options) {
+    this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Polls an erasure request by id. While the job is still running this returns its status only; once it completes, the response also includes the verifiable completion certificate (which contexts were swept, per-context deletion counts, and reports of dangling references and shared rows that were left intact). Requires a root API key.
+   * Submits a right-to-erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure removes exactly the data the subject solely owns across the declared contexts, plus the subject's identity and lookup rows. It never touches another account's data and never cascades into another subject's data. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
+   *
+   * @param {Vectros.ErasureRequest} request
+   * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   * @throws {@link Vectros.NotImplementedError}
+   *
+   * @example
+   *     await client.compliance.createErasureRequest({
+   *         subjectType: "user"
+   *     })
+   */
+  createErasureRequest(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__createErasureRequest(request, requestOptions));
+  }
+  async __createErasureRequest(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/erasure-requests"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        case 501:
+          throw new NotImplementedError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/erasure-requests");
+  }
+  /**
+   * Polls an erasure request by id. While the job is still running this returns its status only; once it completes, the response also includes the verifiable completion certificate (which contexts were swept, per-context deletion counts, and reports of dangling references and shared rows that were left intact). Requires a root API key.
    *
    * @param {Vectros.GetErasureRequestRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7391,6 +7720,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.listEntities({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         startFrom: "b3BhcXVlLWN1cnNvci1mcm9tLXRoZS1wcmV2aW91cy1wYWdl"
    *     })
    */
@@ -7400,6 +7730,7 @@ var IdentityClient = class {
   async __listEntities(request, requestOptions) {
     const {
       namespace,
+      contextId,
       userId,
       externalId,
       scope,
@@ -7414,6 +7745,7 @@ var IdentityClient = class {
       limit
     } = request;
     const _queryParams = {
+      contextId,
       userId,
       externalId,
       scope,
@@ -7472,6 +7804,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.createEntity({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         body: {
    *             externalId: "team_eng_platform"
    *         }
@@ -7481,9 +7814,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__createEntity(request, requestOptions));
   }
   async __createEntity(request, requestOptions) {
-    const { namespace, upsert, body: _body } = request;
+    const { namespace, upsert, contextId, body: _body } = request;
     const _queryParams = {
-      upsert
+      upsert,
+      contextId
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -7540,14 +7874,18 @@ var IdentityClient = class {
    * @example
    *     await client.identity.getEntity({
    *         namespace: "team",
-   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
+   *         contextId: "myapp"
    *     })
    */
   getEntity(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__getEntity(request, requestOptions));
   }
   async __getEntity(request, requestOptions) {
-    const { namespace, id } = request;
+    const { namespace, id, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7561,7 +7899,7 @@ var IdentityClient = class {
       ),
       method: "GET",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -7598,6 +7936,7 @@ var IdentityClient = class {
    *     await client.identity.updateEntity({
    *         namespace: "team",
    *         id: "id",
+   *         contextId: "myapp",
    *         body: {
    *             externalId: "team_eng_platform"
    *         }
@@ -7607,7 +7946,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__updateEntity(request, requestOptions));
   }
   async __updateEntity(request, requestOptions) {
-    const { namespace, id, body: _body } = request;
+    const { namespace, id, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7622,7 +7964,7 @@ var IdentityClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -7662,14 +8004,18 @@ var IdentityClient = class {
    * @example
    *     await client.identity.deleteEntity({
    *         namespace: "team",
-   *         id: "id"
+   *         id: "id",
+   *         contextId: "myapp"
    *     })
    */
   deleteEntity(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__deleteEntity(request, requestOptions));
   }
   async __deleteEntity(request, requestOptions) {
-    const { namespace, id } = request;
+    const { namespace, id, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7683,7 +8029,7 @@ var IdentityClient = class {
       ),
       method: "DELETE",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -7726,6 +8072,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.lookupEntities({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         body: {
    *             type: "person_v1",
    *             field: "ssn"
@@ -7736,7 +8083,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__lookupEntities(request, requestOptions));
   }
   async __lookupEntities(request, requestOptions) {
-    const { namespace, body: _body } = request;
+    const { namespace, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7751,7 +8101,7 @@ var IdentityClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -7795,15 +8145,17 @@ var IdentityClient = class {
    * @example
    *     await client.identity.getEntityVersions({
    *         namespace: "team",
-   *         id: "id"
+   *         id: "id",
+   *         contextId: "myapp"
    *     })
    */
   getEntityVersions(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__getEntityVersions(request, requestOptions));
   }
   async __getEntityVersions(request, requestOptions) {
-    const { namespace, id, startFrom } = request;
+    const { namespace, id, contextId, startFrom } = request;
     const _queryParams = {
+      contextId,
       startFrom
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
@@ -7865,7 +8217,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__getNamespace(request, requestOptions));
   }
   async __getNamespace(request, requestOptions) {
-    const { namespace } = request;
+    const { namespace, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7879,7 +8234,7 @@ var IdentityClient = class {
       ),
       method: "GET",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -7904,7 +8259,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces/{namespace}");
   }
   /**
-   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`, `specificityRank`) of a registered namespace. The namespace name itself is immutable. Requires a root API key. The reserved built-ins cannot be updated.
+   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`, `specificityRank`) of a registered namespace. The namespace name and its `contextId` (which row is selected) are both immutable. Requires a root API key. `org` and `client` are updatable like any other namespace — there is no reserved-built-in exception.
    *
    * @param {Vectros.UpdateNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7926,7 +8281,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__updateNamespace(request, requestOptions));
   }
   async __updateNamespace(request, requestOptions) {
-    const { namespace, body: _body } = request;
+    const { namespace, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7941,7 +8299,7 @@ var IdentityClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -7972,7 +8330,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/namespaces/{namespace}");
   }
   /**
-   * Deletes a registered scope namespace. Requires a root API key. The reserved built-ins cannot be deleted. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
+   * Deletes a registered scope namespace. Requires a root API key. `org` and `client` are deletable like any other namespace — there is no reserved-built-in exception. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
    *
    * @param {Vectros.DeleteNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7990,7 +8348,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__deleteNamespace(request, requestOptions));
   }
   async __deleteNamespace(request, requestOptions) {
-    const { namespace } = request;
+    const { namespace, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8004,7 +8365,7 @@ var IdentityClient = class {
       ),
       method: "DELETE",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8033,7 +8394,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/namespaces/{namespace}");
   }
   /**
-   * Returns the scope namespaces registered in your account, with the reserved built-ins `org` and `client` listed first. Returns a `{data, nextCursor}` envelope.
+   * Returns the scope namespaces in your account, including `org` and `client`, which are provisioned for you when the account is created. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListNamespacesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8045,10 +8406,11 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__listNamespaces(request, requestOptions));
   }
   async __listNamespaces(request = {}, requestOptions) {
-    const { startFrom, limit } = request;
+    const { startFrom, limit, contextId } = request;
     const _queryParams = {
       startFrom,
-      limit
+      limit,
+      contextId
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -8083,9 +8445,9 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces");
   }
   /**
-   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key. The reserved names `org` and `client` are built in and cannot be registered.
+   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. `org` and `client` are provisioned when your account is created, so registering either returns the already-registered error.
    *
-   * @param {Vectros.NamespaceRequest} request
+   * @param {Vectros.RegisterNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
@@ -8094,14 +8456,20 @@ var IdentityClient = class {
    *
    * @example
    *     await client.identity.registerNamespace({
-   *         namespace: "team",
-   *         specificityRank: 1500
+   *         body: {
+   *             namespace: "team",
+   *             specificityRank: 1500
+   *         }
    *     })
    */
   registerNamespace(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__registerNamespace(request, requestOptions));
   }
   async __registerNamespace(request, requestOptions) {
+    const { contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8116,9 +8484,9 @@ var IdentityClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
-      body: request,
+      body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8403,12 +8771,13 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/users/{id}");
   }
   /**
-   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope.
+   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner.
    *
    * @param {Vectros.DeleteUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8448,6 +8817,8 @@ var IdentityClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -8521,6 +8892,69 @@ var IdentityClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/lookup");
   }
+  /**
+   * Answers "does a user with this email hold an ACTIVE access profile in this app context" — a narrow existence check, not a general lookup. `exists` is false for a member whose access to this context has been suspended, not only for a member who was never granted it. The answer is scoped to the `contextId` you supply: it does not reveal whether the email exists elsewhere in your tenant or account, only whether it belongs to an active member of the named context. Returns `{exists, userId, status}` — never the full user record — so a caller asking "does X exist" cannot receive that user's payload/schema binding/etc. as a side effect. Useful for resolving an email you were handed (for example, by an org-admin adding an existing member to another org) to a `userId`, without paging through the full context membership. Requires the `users:r` scope.
+   *
+   * @param {Vectros.UserExistsByEmailRequest} request
+   * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   *
+   * @example
+   *     await client.identity.userExistsByEmail({
+   *         email: "user@example.com",
+   *         contextId: "myapp"
+   *     })
+   */
+  userExistsByEmail(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__userExistsByEmail(request, requestOptions));
+  }
+  async __userExistsByEmail(request = {}, requestOptions) {
+    const { email, contextId } = request;
+    const _queryParams = {
+      email,
+      contextId
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/users/exists-by-email"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/exists-by-email");
+  }
   /**
    * Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
    *
@@ -10238,10 +10672,11 @@ var logging;
   logging2.ConsoleLogger = ConsoleLogger;
 })(logging || (logging = {}));
 
-// node_modules/@vectros-ai/blueprints/dist/index.mjs
+// ../blueprints/dist/index.mjs
 import { z } from "zod";
 import { z as z2 } from "zod";
 var CONTEXT_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
+var MAX_SCOPE_DIMENSIONS = 2;
 var ValidationRulesSchema = z.object({
   required: z.boolean().optional(),
   minLength: z.number().int().optional(),
@@ -10436,11 +10871,14 @@ var BlueprintSchemaSchema = z.object({
   // Schema-level ownership defaults, matching `SchemaRequest`: the principal
   // `userId` plus `scopes` — namespaced parent edges as `<namespace>:<value>`
   // (`org:...`, `client:...`, or a namespace you registered), at most two
-  // namespaces. The flat `orgId`/`clientId` fields fold into `scopes`.
+  // namespaces. The flat `orgId`/`clientId` fields fold into `scopes`. Each
+  // entry's namespace + value are validated below
+  // (`lintNamespacedScopeArrays`) — this `.max(MAX_SCOPE_DIMENSIONS)` is
+  // only the shape-level cap, not the grammar check.
   // With a scoped token these must be consistent with the profile's dataScope
   // (a cross-consistency lint is deferred to the lint slice).
   userId: z.string().min(1).optional(),
-  scopes: z.array(z.string().min(1)).max(2).optional(),
+  scopes: z.array(z.string().min(1)).max(MAX_SCOPE_DIMENSIONS).optional(),
   // The id of an existing schema this one is a CUSTOMIZATION of, when a schema
   // named `typeName` already exists in this context — required in that case,
   // and must be omitted when this create is the first schema under that name
@@ -10463,6 +10901,35 @@ var BlueprintSchemaSchema = z.object({
     });
   }
 });
+var CAPABILITY_NAME_RE = /^[a-z][a-z0-9-]*$/;
+var GrantedCapabilitiesSchema = z.array(z.string().min(1)).optional().superRefine((caps, ctx) => {
+  if (!caps) return;
+  const seen = /* @__PURE__ */ new Set();
+  caps.forEach((name, i) => {
+    if (name === "") return;
+    if (name === "*") {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [i],
+        message: "'*' is not a capability \u2014 granted_capabilities has no wildcard, and a '*' in allowedActions confers zero capabilities. Name each capability explicitly."
+      });
+    } else if (!CAPABILITY_NAME_RE.test(name)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [i],
+        message: `'${name}' is not a valid capability name (expected lowercase letters, digits and hyphens, starting with a letter, and no ':' \u2014 a capability is not an action)`
+      });
+    }
+    if (seen.has(name)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [i],
+        message: `'${name}' is declared more than once`
+      });
+    }
+    seen.add(name);
+  });
+});
 var BlueprintAccessProfileSchema = z.object({
   // Validated structurally here; the SCOPE GATE (in @vectros-ai/cli) is
   // what enforces the data-plane-only security boundary.
@@ -10478,7 +10945,9 @@ var BlueprintAccessProfileSchema = z.object({
   // ...) — the flat `orgId`/`clientId` keys are gone. e.g.
   // `{ "scope:org": ["org_x", null] }` = "org_x's records AND tenant-shared
   // records". Omitting null restricts to the listed owners ONLY (the key will
-  // NOT see tenant-level/seed records).
+  // NOT see tenant-level/seed records). Every KEY is validated below
+  // (`lintDataScopeKeys`) — `userId` or a grammar-valid `scope:<ns>`, no
+  // other shape.
   dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
   // Optional identity overrides for the service principal's profile — scope
   // values its key STAMPS onto everything it writes (a credential can only
@@ -10487,11 +10956,36 @@ var BlueprintAccessProfileSchema = z.object({
   // `orgId`/`clientId` keys are gone); values may be `${{ identities.* }}`
   // tokens (substituted at apply time). e.g. `{ "scope:org": '${{ identities.team }}' }`
   // makes every record the service key writes org/team-owned.
-  identityOverrides: z.record(z.string().min(1)).optional()
+  //
+  // Every KEY, the ≤2-dimension cap, and every LITERAL value are validated
+  // below (`lintIdentityOverrides`, placeholder-aware — see that function's
+  // docstring); this `.min(1)` is only the shape-level "non-blank" guard on
+  // the value, not the grammar check.
+  identityOverrides: z.record(z.string().min(1)).optional(),
+  // Optional capabilities granted to the blueprint's own service-principal
+  // profile. DECISION: allowed here, not role-clause-only. On the platform,
+  // an access profile's scopes are themselves a list of clauses — the exact
+  // same wire shape a role clause carries — and the loader already builds
+  // this profile as ONE such clause. Refusing `capabilities` here while
+  // allowing it on a role clause would be an asymmetry this FORMAT package
+  // has no basis to invent: nothing on the platform side distinguishes the
+  // two, and whether granting a capability to a blueprint's own service key
+  // is sound POLICY is exactly the question the CLI's scope gate exists to
+  // answer (a separate package, out of scope for this format layer) — the
+  // same posture this package already takes with `allowedActions` above.
+  //
+  // Worth naming for whoever writes that gate: this profile is a long-lived,
+  // non-human-attributable machine credential (typically stored in CI/CD
+  // secrets), not an ephemeral human session — a materially different
+  // blast-radius question from granting the same capability to a role that
+  // a person is bound to. The gate should weigh the two separately rather
+  // than reuse one policy for both.
+  capabilities: GrantedCapabilitiesSchema
 }).strict();
 var BlueprintRoleClauseSchema = z.object({
   allowedActions: z.array(z.string().min(1)).min(1),
-  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional()
+  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
+  capabilities: GrantedCapabilitiesSchema
 }).strict();
 var BlueprintRolesSchema = z.record(z.array(BlueprintRoleClauseSchema).min(1));
 var IDENTITY_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
@@ -10516,57 +11010,260 @@ var IdentityDeclSchema = z.object({
   displayName: z.string().min(1).optional(),
   metadata: z.record(z.unknown()).optional()
 }).strict();
-var IdentitiesDeclSchema = z.record(IdentityDeclSchema);
+var IDENTITY_NAME_RE = /^[A-Za-z_]\w*$/;
+var IdentitiesDeclSchema = z.record(
+  z.string().regex(IDENTITY_NAME_RE, {
+    message: "identity name must match letters/digits/underscore, not starting with a digit (e.g. 'demoOrg', not 'demo-org') \u2014 '${{ identities.<name> }}' can never reference a name outside this grammar"
+  }),
+  IdentityDeclSchema
+);
 var BlueprintServicePrincipalSchema = z.object({
   externalId: z.string().min(1),
   displayName: z.string().min(1)
 }).strict();
-var SeedCommonShape = {
-  /** The schema typeName this seed instantiates (should match a declared schema). */
-  typeName: z.string().min(1),
+var ISSUER_ID_RE = CONTEXT_ID_RE;
+var BlueprintIssuerSchema = z.object({
+  /** Short slug identifying this issuer within your account. Immutable once registered. */
+  issuerId: z.string().regex(ISSUER_ID_RE, {
+    message: "issuerId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'auth0-prod')"
+  }),
+  /** The IdP's `iss` claim value, exactly as it appears in tokens it issues. */
+  issuer: z.string().min(1),
+  /** The IdP's remote JWKS endpoint, used to verify presented tokens' signatures. */
+  jwksUri: z.string().min(1),
   /**
-   * Stable, caller-supplied id — the loader's idempotency key AND the value other
-   * seeds resolve a `reference` against (across surfaces: a record seed may
-   * reference a document seed by its externalId, and vice versa).
+   * The `aud` claim value a presented subject_token must carry. Must be globally
+   * unique in combination with `issuer` — use a distinct audience per
+   * environment/context sharing one IdP account (most OIDC providers support
+   * this as an ordinary per-API/application default).
    */
-  externalId: z.string().min(1),
+  audience: z.string().min(1),
   /**
-   * Optional scope ownership for the seeded item, as `namespace:value` entries
-   * (≤2, e.g. `['org:${{ identities.team }}']`; tokens substitute at apply
-   * time). `[]` = a private, user-owned item. Omitted = the seeding
-   * credential's full identity (the default).
+   * Which app context an exchanged token targets. **Must equal the blueprint's own
+   * `contextId`** — an issuer is a trust anchor, so a blueprint may only attach one to the
+   * context it actually provisions. One IdP account serving several contexts needs one entry
+   * per context, each in that context's own blueprint.
    */
-  scopes: z.array(z.string()).optional()
-};
-var RecordSeedSchema = z.object({
-  surface: z.literal("record"),
-  ...SeedCommonShape,
-  /** The record payload, validated against the bound schema. */
-  fields: z.record(z.unknown())
+  contextId: z.string().regex(CONTEXT_ID_RE, {
+    message: "contextId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'casework')"
+  }),
+  /** The claim carrying the subject identifier. Platform defaults to 'sub' when omitted. */
+  subClaim: z.string().min(1).optional(),
+  /** The claim carrying the subject's email (first-login invite matching). Platform defaults to 'email' when omitted. */
+  emailClaim: z.string().min(1).optional(),
+  /**
+   * Opt-in self-service signup: a list of {signupType, roleId} pairs. When a first-time exchange
+   * caller presents no invite token but names a signupType matching one of these (or omits it and
+   * exactly one entry exists), a brand-new user is created and bound to that entry's role, no
+   * invite required. Every entry must be something you're willing to grant to ANY caller who can
+   * present a token from this issuer — a role carrying elevated (provisioning or wildcard) scope
+   * is rejected. Omit entirely to leave self-signup disabled (the default).
+   */
+  selfSignupPolicies: z.array(
+    z.object({
+      signupType: z.string().regex(ISSUER_ID_RE, {
+        message: "signupType must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'practitioner')"
+      }),
+      roleId: z.string().regex(ISSUER_ID_RE, {
+        message: "roleId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'practitioner-member')"
+      })
+    }).strict()
+  ).optional()
 }).strict();
-var DocumentSeedSchema = z.object({
-  surface: z.literal("document"),
-  ...SeedCommonShape,
-  /** Human-readable document title — REQUIRED by the text-ingest path. */
-  title: z.string().min(1),
-  /** Raw text content to ingest + index — REQUIRED and non-empty (the platform rejects a blank ingest). */
-  text: z.string().min(1),
-  /** Optional structured payload bound to the schema (the document's `fields`). */
-  fields: z.record(z.unknown()).optional()
+var BlueprintNamespaceSchema = z.object({
+  /** The namespace to register — same grammar as a `scope:<namespace>` key. */
+  namespace: z.string().min(1),
+  /**
+   * When `true`, every value in this namespace must resolve to an existing
+   * identity entity (create via `entities:c` at the in-context phase, or a
+   * declared `identities:` entry). When `false`/omitted, values are
+   * free-form strings validated by grammar only.
+   */
+  entityBacked: z.boolean().optional(),
+  /**
+   * This namespace's position in your account's specificity order (used to
+   * break a tie when a caller holds two scope dimensions at once). Required
+   * by the platform on registration; MUST be unique across every namespace
+   * in the account, including `org` (1000) and `client` (2000) — pick a
+   * value outside that pair, and outside any other namespace this same
+   * account might register (its own, or another blueprint's).
+   */
+  specificityRank: z.number().int().min(0).max(1e6),
+  /**
+   * Optional membership backing — declares which record type + field hold
+   * grants of THIS namespace's values. Supply together with
+   * `membershipTargetField`, or omit both. Declaring this grants nobody
+   * anything on its own: a role opts in explicitly with
+   * `${{ member.scope.<namespace> }}` in its `dataScope`.
+   */
+  membershipRecordType: z.string().min(1).optional(),
+  /** The field on `membershipRecordType` naming the user a grant is FOR. Required alongside `membershipRecordType`. */
+  membershipTargetField: z.string().min(1).optional(),
+  /**
+   * The field on `membershipRecordType` naming a grant's LEVEL, so the same
+   * user can hold different levels in different values of this namespace.
+   * Supply together with `membershipLevels`, or omit both for plain
+   * in-or-out membership.
+   */
+  membershipLevelField: z.string().min(1).optional(),
+  /** The complete set of level labels this namespace allows. Required alongside `membershipLevelField`. */
+  membershipLevels: z.array(z.string().min(1)).optional()
 }).strict();
-var BlueprintSeedRecordSchema = z.discriminatedUnion("surface", [
-  RecordSeedSchema,
-  DocumentSeedSchema
-]);
-var SELF_TOKEN_RE = /\$\{\{\s*self\.[A-Za-z_]\w*\s*\}\}/;
-function lintSelfTokenPlacement(value, ctx) {
-  const walk = (node, path4, inRoleDataScope) => {
-    if (typeof node === "string") {
-      if (!inRoleDataScope && SELF_TOKEN_RE.test(node)) {
+var MEMBERSHIP_FIELD_NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
+function lintNamespaces(value, ctx) {
+  if (!value || typeof value !== "object" || !("namespaces" in value)) return;
+  const namespaces = value.namespaces;
+  if (!Array.isArray(namespaces)) return;
+  const rawSchemas = value.schemas;
+  const declaredSchemaTypes = new Set(
+    (Array.isArray(rawSchemas) ? rawSchemas : []).map((s) => s && typeof s === "object" && "typeName" in s ? s.typeName : void 0).filter((t) => typeof t === "string")
+  );
+  const seenNames = /* @__PURE__ */ new Set();
+  const seenRanks = /* @__PURE__ */ new Map();
+  namespaces.forEach((entry, i) => {
+    if (!entry || typeof entry !== "object") return;
+    const ns = entry;
+    const path4 = ["namespaces", i];
+    if (typeof ns.namespace === "string") {
+      const err = scopeNamespaceGrammarError(ns.namespace);
+      if (err) ctx.addIssue({ code: z.ZodIssueCode.custom, path: [...path4, "namespace"], message: err });
+      if (seenNames.has(ns.namespace)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [...path4, "namespace"],
+          message: `'${ns.namespace}' is declared more than once in namespaces[]`
+        });
+      }
+      seenNames.add(ns.namespace);
+    }
+    if (typeof ns.specificityRank === "number") {
+      const prior = seenRanks.get(ns.specificityRank);
+      if (prior !== void 0) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [...path4, "specificityRank"],
+          message: `specificityRank ${ns.specificityRank} is already used by namespaces[${prior}] \u2014 every namespace's rank must be unique`
+        });
+      }
+      seenRanks.set(ns.specificityRank, i);
+    }
+    const hasRecordType = ns.membershipRecordType !== void 0;
+    const hasTargetField = ns.membershipTargetField !== void 0;
+    if (hasRecordType !== hasTargetField) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path4, "membershipRecordType"],
+        message: "membershipRecordType and membershipTargetField must be declared together, or neither"
+      });
+    }
+    if (typeof ns.membershipRecordType === "string" && !declaredSchemaTypes.has(ns.membershipRecordType)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path4, "membershipRecordType"],
+        message: `membershipRecordType '${ns.membershipRecordType}' must name a typeName this blueprint declares in schemas[] \u2014 a namespace's membership can only resolve over a record type the blueprint itself ships, never a type that merely happens to already exist in the target context.`
+      });
+    }
+    for (const [field, value2] of [
+      ["membershipRecordType", ns.membershipRecordType],
+      ["membershipTargetField", ns.membershipTargetField],
+      ["membershipLevelField", ns.membershipLevelField]
+    ]) {
+      if (typeof value2 === "string" && !MEMBERSHIP_FIELD_NAME_RE.test(value2)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [...path4, field],
+          message: `${field} '${value2}' is invalid \u2014 must be 1-64 characters of letters, digits, underscores, or hyphens`
+        });
+      }
+    }
+    const hasLevelField = ns.membershipLevelField !== void 0;
+    const hasLevels = Array.isArray(ns.membershipLevels) && ns.membershipLevels.length > 0;
+    if (hasLevelField !== hasLevels) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path4, "membershipLevelField"],
+        message: "membershipLevelField and a non-empty membershipLevels must be declared together, or neither"
+      });
+    }
+    if ((hasLevelField || hasLevels) && !hasRecordType) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path4, "membershipLevelField"],
+        message: "membershipLevelField/membershipLevels require membershipRecordType + membershipTargetField too"
+      });
+    }
+    if (Array.isArray(ns.membershipLevels)) {
+      const seenLevels = /* @__PURE__ */ new Set();
+      for (const level of ns.membershipLevels) {
+        if (typeof level !== "string") continue;
+        const err = scopeNamespaceGrammarError(level);
+        if (err) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: [...path4, "membershipLevels"],
+            message: `level '${level}': ${err}`
+          });
+        } else if (seenLevels.has(level)) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: [...path4, "membershipLevels"],
+            message: `membershipLevels contains '${level}' twice`
+          });
+        }
+        seenLevels.add(level);
+      }
+    }
+  });
+}
+var SeedCommonShape = {
+  /** The schema typeName this seed instantiates (should match a declared schema). */
+  typeName: z.string().min(1),
+  /**
+   * Stable, caller-supplied id — the loader's idempotency key AND the value other
+   * seeds resolve a `reference` against (across surfaces: a record seed may
+   * reference a document seed by its externalId, and vice versa).
+   */
+  externalId: z.string().min(1),
+  /**
+   * Optional scope ownership for the seeded item, as `namespace:value` entries
+   * (≤2, e.g. `['org:${{ identities.team }}']`; tokens substitute at apply
+   * time). `[]` = a private, user-owned item. Omitted = the seeding
+   * credential's full identity (the default). Each entry's namespace + value
+   * are validated below (`lintNamespacedScopeArrays`) — this
+   * `.max(MAX_SCOPE_DIMENSIONS)` is only the shape-level cap, not the grammar
+   * check.
+   */
+  scopes: z.array(z.string()).max(MAX_SCOPE_DIMENSIONS).optional()
+};
+var RecordSeedSchema = z.object({
+  surface: z.literal("record"),
+  ...SeedCommonShape,
+  /** The record payload, validated against the bound schema. */
+  fields: z.record(z.unknown())
+}).strict();
+var DocumentSeedSchema = z.object({
+  surface: z.literal("document"),
+  ...SeedCommonShape,
+  /** Human-readable document title — REQUIRED by the text-ingest path. */
+  title: z.string().min(1),
+  /** Raw text content to ingest + index — REQUIRED and non-empty (the platform rejects a blank ingest). */
+  text: z.string().min(1),
+  /** Optional structured payload bound to the schema (the document's `fields`). */
+  fields: z.record(z.unknown()).optional()
+}).strict();
+var BlueprintSeedRecordSchema = z.discriminatedUnion("surface", [
+  RecordSeedSchema,
+  DocumentSeedSchema
+]);
+var SELF_TOKEN_RE = /\$\{\{\s*(?:self|under|member)\.[^}]*?\s*\}\}/;
+function lintSelfTokenPlacement(value, ctx) {
+  const walk = (node, path4, inRoleDataScope) => {
+    if (typeof node === "string") {
+      if (!inRoleDataScope && SELF_TOKEN_RE.test(node)) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
           path: path4,
-          message: "'${{ self.* }}' is a runtime per-principal placeholder \u2014 it is only valid inside a roles[].dataScope value"
+          message: "'${{ self.* }}' / '${{ member.* }}' is a runtime placeholder \u2014 it is only valid inside a roles[].dataScope value"
         });
       }
       return;
@@ -10585,12 +11282,20 @@ function lintSelfTokenPlacement(value, ctx) {
   walk(value, [], false);
 }
 var IDENTITY_REF_RE = /\$\{\{\s*identities\.([A-Za-z_]\w*)\s*\}\}/g;
-function lintIdentityRefsDeclared(value, ctx) {
+var IDENTITY_REF_LOOSE_RE = /\$\{\{\s*identities\.([^}]*?)\s*\}\}/g;
+function lintIdentityRefs(value, ctx) {
   const declared = new Set(
     value && typeof value === "object" && "identities" in value && value.identities ? Object.keys(value.identities) : []
   );
   const walk = (node, path4) => {
     if (typeof node === "string") {
+      for (const m of node.matchAll(IDENTITY_REF_LOOSE_RE)) {
+        const captured = m[1];
+        if (IDENTITY_NAME_RE.test(captured)) continue;
+        const dotIndex = captured.indexOf(".");
+        const message = dotIndex === -1 ? `'\${{ identities.${captured} }}' is not a valid identities reference \u2014 the name must match letters/digits/underscore, not starting with a digit` : `'\${{ identities.${captured} }}' is not valid \u2014 property access ('.${captured.slice(dotIndex + 1)}') is not supported; only the whole identity id can be referenced, as '\${{ identities.${captured.slice(0, dotIndex)} }}'`;
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: path4, message });
+      }
       for (const m of node.matchAll(IDENTITY_REF_RE)) {
         if (!declared.has(m[1])) {
           ctx.addIssue({
@@ -10613,6 +11318,134 @@ function lintIdentityRefsDeclared(value, ctx) {
   };
   walk(value, []);
 }
+var SCOPE_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var SCOPE_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
+var FORBIDDEN_SCOPE_NAMESPACES = /* @__PURE__ */ new Set([
+  "user",
+  "record",
+  "document",
+  "entity",
+  "self",
+  "tenant",
+  "context",
+  "scope",
+  "versions",
+  "lookup"
+]);
+function scopeNamespaceGrammarError(namespace) {
+  if (namespace === "") return "scope namespace must not be blank";
+  if (FORBIDDEN_SCOPE_NAMESPACES.has(namespace)) {
+    return `'${namespace}' is a reserved namespace and cannot be used as an ownership scope`;
+  }
+  if (!SCOPE_NAMESPACE_RE.test(namespace)) {
+    return `'${namespace}' is not a valid namespace \u2014 2-32 chars, lowercase letter first, then lowercase letters, digits, '_' or '-'`;
+  }
+  return null;
+}
+var IDENTITY_PLACEHOLDER_WHOLE_RE = new RegExp(`^${IDENTITY_REF_LOOSE_RE.source}$`);
+function lintIdentityOverrides(value, ctx) {
+  const overrides = value.accessProfile?.identityOverrides;
+  if (!overrides) return;
+  const entries = Object.entries(overrides);
+  if (entries.length > MAX_SCOPE_DIMENSIONS) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["accessProfile", "identityOverrides"],
+      message: `identityOverrides names ${entries.length} scope dimensions \u2014 a record carries at most ${MAX_SCOPE_DIMENSIONS} scope values, so an identity may stamp at most ${MAX_SCOPE_DIMENSIONS}.`
+    });
+  }
+  for (const [key, v] of entries) {
+    const ns = key.startsWith("scope:") ? key.slice("scope:".length) : null;
+    const nsError = ns === null ? null : scopeNamespaceGrammarError(ns);
+    if (ns === null || nsError !== null) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["accessProfile", "identityOverrides", key],
+        message: ns === null ? `'${key}' is not allowed \u2014 identityOverrides keys must be 'scope:org', 'scope:client', or an open 'scope:<namespace>' key (the bare 'orgId'/'clientId' spellings are retired)` : `identityOverrides['${key}'] ${nsError}`
+      });
+    }
+    if (typeof v !== "string") continue;
+    if (IDENTITY_PLACEHOLDER_WHOLE_RE.test(v)) continue;
+    if (!SCOPE_VALUE_RE.test(v)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["accessProfile", "identityOverrides", key],
+        message: `'${v}' is not a valid scope value \u2014 1-128 characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'. A value may not contain ':', '$', '{', or '}' (the one exception is the documented '\${{ identities.<name> }}' substitution token).`
+      });
+    }
+  }
+}
+function lintScopeEntries(entries, path4, ctx) {
+  if (!entries) return;
+  const seenValueByNamespace = /* @__PURE__ */ new Map();
+  for (let i = 0; i < entries.length; i++) {
+    const raw = entries[i];
+    if (typeof raw !== "string") continue;
+    const sep = raw.indexOf(":");
+    if (sep <= 0 || sep === raw.length - 1) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path4, i],
+        message: `'${raw}' must be '<namespace>:<value>' (e.g. 'org:6ba7...' or 'team:${"${{ identities.team }}"}')`
+      });
+      continue;
+    }
+    const namespace = raw.slice(0, sep);
+    const val = raw.slice(sep + 1);
+    const nsError = scopeNamespaceGrammarError(namespace);
+    if (nsError !== null) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, path: [...path4, i], message: `'${raw}' ${nsError}` });
+    } else {
+      const priorValue = seenValueByNamespace.get(namespace);
+      if (priorValue !== void 0 && priorValue !== val) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [...path4, i],
+          message: `'${namespace}' appears more than once with different values ('${priorValue}' and '${val}') \u2014 an item carries at most one value per namespace`
+        });
+      }
+      seenValueByNamespace.set(namespace, val);
+    }
+    if (IDENTITY_PLACEHOLDER_WHOLE_RE.test(val)) continue;
+    if (!SCOPE_VALUE_RE.test(val)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path4, i],
+        message: `'${raw}' has an invalid value \u2014 1-128 characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'. A value may not contain ':', '$', '{', or '}' (the one exception is the documented '\${{ identities.<name> }}' substitution token).`
+      });
+    }
+  }
+}
+function lintNamespacedScopeArrays(value, ctx) {
+  const bp = value;
+  (bp.schemas ?? []).forEach((s, i) => lintScopeEntries(s.scopes, ["schemas", i, "scopes"], ctx));
+  (bp.seed ?? []).forEach((s, i) => lintScopeEntries(s.scopes, ["seed", i, "scopes"], ctx));
+}
+function lintDataScopeKey(key, path4, ctx) {
+  if (key === "userId") return;
+  const ns = key.startsWith("scope:") ? key.slice("scope:".length) : null;
+  const nsError = ns === null ? null : scopeNamespaceGrammarError(ns);
+  if (ns === null || nsError !== null) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: path4,
+      message: ns === null ? `'${key}' is not allowed \u2014 dataScope keys must be 'userId' or a namespaced 'scope:<namespace>' key (the bare 'orgId'/'clientId' spellings are retired)` : `dataScope['${key}'] ${nsError}`
+    });
+  }
+}
+function lintDataScopeKeys(value, ctx) {
+  const bp = value;
+  for (const key of Object.keys(bp.accessProfile?.dataScope ?? {})) {
+    lintDataScopeKey(key, ["accessProfile", "dataScope", key], ctx);
+  }
+  for (const [roleId, clauses] of Object.entries(bp.roles ?? {})) {
+    clauses.forEach((clause, i) => {
+      for (const key of Object.keys(clause.dataScope ?? {})) {
+        lintDataScopeKey(key, ["roles", roleId, i, "dataScope", key], ctx);
+      }
+    });
+  }
+}
 function lintSeedSurfaces(value, ctx) {
   const bp = value;
   if (!Array.isArray(bp.seed)) return;
@@ -10630,6 +11463,41 @@ function lintSeedSurfaces(value, ctx) {
     }
   });
 }
+function lintIdentitySurfaces(value, ctx) {
+  const bp = value;
+  if (!Array.isArray(bp.schemas)) return;
+  bp.schemas.forEach((schema, i) => {
+    if (!schema.allowedSurfaces?.includes("user")) return;
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["schemas", i, "allowedSurfaces"],
+      message: `schema '${schema.typeName}': allowedSurfaces cannot include 'user' \u2014 a user-surfaced schema is account-global and requires a root API key, which no blueprint credential ever holds, so this would fail at apply with a 403. Model the data as a 'record' scoped to the user, or as an 'entity' schema (which a blueprint CAN provision, in its own app context).`
+    });
+  });
+}
+function lintIssuerContext(value, ctx) {
+  const bp = value;
+  if (!Array.isArray(bp.issuers)) return;
+  bp.issuers.forEach((issuer, i) => {
+    if (issuer.contextId === void 0 || issuer.contextId === bp.contextId) return;
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["issuers", i, "contextId"],
+      message: `issuer '${issuer.issuerId}' targets app context '${issuer.contextId}', but this blueprint provisions '${bp.contextId}'. An issuer must target the blueprint's own context \u2014 everything else a blueprint creates does, and an issuer that points elsewhere attaches an identity provider to an app context the blueprint never mentions. Set it to '${bp.contextId}', or move this issuer into a blueprint for '${issuer.contextId}'.`
+    });
+  });
+}
+var BLUEPRINT_FIELD_PHASES = Object.freeze({
+  servicePrincipal: "bootstrap",
+  issuers: "bootstrap",
+  // Registration requires the platform's provisioning:c capability, which
+  // only the bootstrap credential carries — same reasoning as issuers.
+  namespaces: "bootstrap",
+  schemas: "in-context",
+  accessProfile: "in-context",
+  roles: "in-context",
+  seed: "in-context"
+});
 var BlueprintSchema = z.object({
   /** Stable blueprint id (the `--blueprint <name>` selector + idempotency key). */
   name: z.string().min(1),
@@ -10648,11 +11516,33 @@ var BlueprintSchema = z.object({
   /** Optional multi-clause roles, bound to principals via `access grant --role`. */
   roles: BlueprintRolesSchema.optional(),
   /** Optional principals ensured-exist at apply; referenced via ${{ identities.* }}. */
-  identities: IdentitiesDeclSchema.optional()
+  identities: IdentitiesDeclSchema.optional(),
+  /**
+   * Optional trusted third-party IdP issuers to register (BYO-IdP token
+   * exchange). Applied in the BOOTSTRAP-token phase, alongside app-context/
+   * service-principal creation — NOT the in-context load (see
+   * {@link BlueprintIssuerSchema}).
+   */
+  issuers: z.array(BlueprintIssuerSchema).optional(),
+  /**
+   * Optional namespaces to register before anything else needs them — see
+   * {@link BlueprintNamespaceSchema}. Applied in the BOOTSTRAP-token phase,
+   * alongside app-context/service-principal creation and issuers, BEFORE
+   * schemas/seed (an `entityBacked` namespace's entities, and an
+   * `allowedSurfaces: ['entity']` schema, both need the registration to
+   * already exist). `org`/`client` need no entry — they exist already.
+   */
+  namespaces: z.array(BlueprintNamespaceSchema).optional()
 }).strict().superRefine((bp, ctx) => {
   lintSelfTokenPlacement(bp, ctx);
-  lintIdentityRefsDeclared(bp, ctx);
+  lintIdentityRefs(bp, ctx);
+  lintIdentityOverrides(bp, ctx);
+  lintNamespacedScopeArrays(bp, ctx);
+  lintDataScopeKeys(bp, ctx);
   lintSeedSurfaces(bp, ctx);
+  lintIdentitySurfaces(bp, ctx);
+  lintIssuerContext(bp, ctx);
+  lintNamespaces(bp, ctx);
 });
 function formatIssuePath(path4) {
   let out = "";
@@ -10807,7 +11697,11 @@ function deriveSuffix(contextId) {
 var WHOLE_TOKEN_RE = /^\$\{\{\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*\}\}$/;
 var TOKEN_SCAN_RE = /\$\$\{\{|\$\{\{([\s\S]*?)\}\}|\$\{\{/g;
 var INNER_REF_RE = /^([A-Za-z_]\w*)\.([A-Za-z_]\w*)$/;
-var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities"]);
+var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under", "member"]);
+var DEFERRED_NS_ALTERNATION = [...DEFERRED_NAMESPACES].join("|");
+var DEFERRED_INNER_RE = new RegExp(
+  `^(?:${DEFERRED_NS_ALTERNATION})(?:\\.[A-Za-z_]\\w*)+(?::[A-Za-z_]\\w*)?$`
+);
 function resolveRef(ns, name, ctx, path4) {
   if (ns === "inputs") {
     if (!(name in ctx.declared)) {
@@ -10865,14 +11759,17 @@ function interpolate(str, ctx, path4) {
       });
     } else {
       const inner = (m[1] ?? "").trim();
+      if (DEFERRED_INNER_RE.test(inner)) {
+        out += m[0];
+        last = TOKEN_SCAN_RE.lastIndex;
+        continue;
+      }
       const ref = inner.match(INNER_REF_RE);
       if (!ref) {
         ctx.issues.push({
           path: path4,
           message: `malformed reference '\${{ ${inner} }}' \u2014 expected '\${{ namespace.name }}' (escape a literal with '$\${{')`
         });
-      } else if (DEFERRED_NAMESPACES.has(ref[1])) {
-        out += m[0];
       } else {
         const v = resolveRef(ref[1], ref[2], ctx, path4);
         if (v !== void 0) out += String(v);
@@ -11054,324 +11951,82 @@ var taskManagement = {
           // Equality, NOT range: the values are an ordinal vocabulary but they sort
           // LEXICALLY (high < low < medium < urgent), not by severity — a range
           // index here would be permanently wrong. Filter by exact priority instead.
-          renderHints: { label: "Priority", widget: "select", order: 4, section: "Tracking" }
-        },
-        {
-          fieldId: "assignee",
-          fieldType: "string",
-          filterable: true,
-          description: "userId or display name.",
-          renderHints: { label: "Assignee", widget: "text", order: 5, section: "Tracking" }
-        },
-        {
-          fieldId: "project",
-          fieldType: "string",
-          filterable: true,
-          description: "Grouping key for cross-session continuity.",
-          renderHints: { label: "Project", widget: "text", order: 6, section: "Tracking" }
-        },
-        {
-          fieldId: "dueDate",
-          fieldType: "date",
-          description: "ISO-8601. Range-queryable (see lookupFields) \u2014 list tasks due in a window.",
-          renderHints: { label: "Due date", widget: "date", order: 7, section: "Tracking" }
-        },
-        {
-          fieldId: "tags",
-          fieldType: "array",
-          filterable: true,
-          renderHints: { label: "Tags", order: 8, section: "Tracking" }
-        }
-        // externalId is the record's FIRST-CLASS identifier (the dedup/lookup key + the
-        // value a `reference` resolves against) — not a payload field; the loader sends
-        // it top-level on the RecordRequest.
-      ],
-      // Two lookup shapes, chosen deliberately because the equality-vs-range choice
-      // per field is MIGRATION-LOCKED once the schema is live (you cannot flip a
-      // field slot↔range later, even by removing and re-adding it):
-      //   • `project` — EQUALITY (a grouping key, not ordered): enumerate one
-      //     project's tasks directly, no search. Each equality lookup uses 1 of the
-      //     schema's 7 fast index slots.
-      //   • `dueDate` — RANGE: ordered `from`/`to`/`prefix` queries ("tasks due this
-      //     week", "due in 2026-06"). Range lookups use a relationship row, not a
-      //     slot, and are billed at the range rate. ISO-8601 sorts chronologically,
-      //     so the order is correct.
-      // `externalId` has a built-in first-class finder and must NOT be redeclared here.
-      lookupFields: ["project", { fieldName: "dueDate", rangeEnabled: true }]
-    }
-  ],
-  // Least-privilege profile — MUST pass the CLI scope gate.
-  // r/c/u + search + schema discovery. NOT records:d (least privilege).
-  accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"]
-    // dataScope omitted → tenant-level shared tracker. Add a `scope:org`
-    // entry for per-org isolation.
-  },
-  servicePrincipal: {
-    externalId: "task-management",
-    displayName: "Task Management"
-  },
-  seed: [
-    {
-      surface: "record",
-      typeName: "task",
-      externalId: "seed-welcome",
-      fields: {
-        title: "Welcome to your Vectros task tracker",
-        description: "Created by the bootstrap loader. Ask your agent to add tasks.",
-        status: "todo",
-        priority: "low",
-        project: "getting-started",
-        dueDate: "2026-06-30"
-      }
-    }
-  ]
-};
-var task_management_default = taskManagement;
-var codingAgentMemory = {
-  name: "coding-agent-memory",
-  version: "1.0.0",
-  description: "Persistent project memory for a coding agent \u2014 decisions, conventions, and gotchas that survive across sessions.",
-  contextId: "coding-memory",
-  contextName: "Coding Agent \u2014 Project Memory",
-  schemas: [
-    {
-      // A durable architectural/product decision: what was decided, and WHY.
-      // The rationale is the high-value, RAG-able body — "why did we do X?"
-      // is the question a cold-context agent most needs answered.
-      typeName: "decision",
-      displayName: "Decision",
-      indexMode: "HYBRID",
-      // keyword on titles + semantic on statement/rationale
-      fields: [
-        {
-          fieldId: "title",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 200 },
-          renderHints: { label: "Title", widget: "text", order: 1, displayField: true }
-        },
-        {
-          fieldId: "statement",
-          fieldType: "string",
-          searchable: true,
-          description: "What was decided, in one or two sentences.",
-          renderHints: { label: "Statement", widget: "textarea", order: 2 }
-        },
-        {
-          fieldId: "rationale",
-          fieldType: "string",
-          searchable: true,
-          description: "Why \u2014 the trade-offs and the context. The most-recalled field.",
-          renderHints: { label: "Rationale", widget: "textarea", order: 3 }
-        },
-        {
-          fieldId: "status",
-          fieldType: "enum",
-          filterable: true,
-          enumValues: ["proposed", "active", "superseded"],
-          renderHints: { label: "Status", widget: "select", order: 4 }
-        },
-        {
-          fieldId: "area",
-          fieldType: "string",
-          filterable: true,
-          description: 'Subsystem / module the decision applies to (e.g. "auth", "search").',
-          renderHints: { label: "Area", widget: "text", order: 5 }
-        },
-        {
-          fieldId: "decidedOn",
-          fieldType: "date",
-          description: 'ISO-8601 date. Range-queryable \u2014 "decisions made this quarter".',
-          renderHints: { label: "Decided on", widget: "date", order: 6 }
-        }
-        // externalId is the record's FIRST-CLASS identifier (the dedup/upsert key + the
-        // value a `reference` resolves against) — it is NOT a payload field, so it is not
-        // declared here; the loader sends it top-level on the RecordRequest.
-      ],
-      // `externalId` is a first-class identifier with its own finder (exact
-      // get/upsert) — look it up directly, never redeclare it as a schema lookup.
-      // The choice below is MIGRATION-LOCKED once the schema is live:
-      //   • `area`/`status` — EQUALITY (categorical): "list active decisions",
-      //     "all decisions in the auth area". 2 of the 7 fast index slots.
-      //   • `decidedOn` — RANGE: ordered `from`/`to`/`prefix` over the date.
-      lookupFields: ["area", "status", { fieldName: "decidedOn", rangeEnabled: true }]
-    },
-    {
-      // A coding convention the team follows — the agent reads these before it
-      // writes code so it matches the surrounding style instead of inventing one.
-      typeName: "convention",
-      displayName: "Convention",
-      indexMode: "HYBRID",
-      fields: [
-        {
-          fieldId: "name",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 200 },
-          renderHints: { label: "Name", widget: "text", order: 1, displayField: true }
-        },
-        {
-          fieldId: "rule",
-          fieldType: "string",
-          searchable: true,
-          description: "The convention itself, stated as an imperative.",
-          renderHints: { label: "Rule", widget: "textarea", order: 2 }
-        },
-        {
-          fieldId: "area",
-          fieldType: "string",
-          filterable: true,
-          renderHints: { label: "Area", widget: "text", order: 3 }
-        },
-        {
-          // Parallels `decision.status` so a convention can be RETIRED rather than
-          // deleted (the blueprint omits records:d — memory is superseded, not lost).
-          fieldId: "status",
-          fieldType: "enum",
-          filterable: true,
-          enumValues: ["active", "retired"],
-          renderHints: { label: "Status", widget: "select", order: 4 }
-        },
-        {
-          // A typed REFERENCE to the decision that established this convention — a
-          // foreign-key link between record types (the knowledge-graph edge). The
-          // platform requires both the target type AND its surface; the value is the
-          // target decision's externalId (the default `targetField`). Provenance:
-          // "why does this convention exist? → open the decision behind it." Not
-          // searchable (a foreign-key id is search noise); declared as an equality
-          // lookup below so you can also enumerate "conventions from decision X".
-          fieldId: "establishedByDecision",
-          fieldType: "reference",
-          targetTypeName: "decision",
-          targetSurface: "record",
-          targetField: "externalId",
-          cardinality: "one",
-          renderHints: { label: "Established by (decision)", order: 5 }
-        },
-        {
-          fieldId: "adoptedOn",
-          fieldType: "date",
-          description: "ISO-8601 \u2014 when this convention was adopted. Range-queryable.",
-          renderHints: { label: "Adopted on", widget: "date", order: 6 }
-        }
-        // externalId: first-class identifier, not a payload field (see `decision`).
-      ],
-      // externalId has its own first-class finder for exact get — look it up
-      // directly, not as a schema lookup. Locked equality-vs-range choices:
-      //   • `area`/`status` — EQUALITY: "active conventions for auth".
-      //   • `establishedByDecision` — EQUALITY on the reference value: enumerate
-      //     "conventions established by decision X" (a forward link query; the
-      //     platform has no reverse-reference index on this surface).
-      //   • `adoptedOn` — RANGE over the adoption date.
-      // 3 equality lookups (of 7 fast slots) + 1 range row.
-      lookupFields: ["area", "status", "establishedByDecision", { fieldName: "adoptedOn", rangeEnabled: true }]
-    },
-    {
-      // A gotcha / sharp edge: a symptom, its cause, and the fix. Saves the
-      // agent (and the human) from re-discovering the same trap.
-      typeName: "gotcha",
-      displayName: "Gotcha",
-      indexMode: "HYBRID",
-      fields: [
-        {
-          fieldId: "symptom",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 500 },
-          renderHints: { label: "Symptom", widget: "textarea", order: 1, displayField: true }
-        },
-        {
-          fieldId: "cause",
-          fieldType: "string",
-          searchable: true,
-          renderHints: { label: "Cause", widget: "textarea", order: 2 }
+          renderHints: { label: "Priority", widget: "select", order: 4, section: "Tracking" }
         },
         {
-          fieldId: "fix",
+          fieldId: "assignee",
           fieldType: "string",
-          searchable: true,
-          renderHints: { label: "Fix", widget: "textarea", order: 3 }
+          filterable: true,
+          description: "userId or display name.",
+          renderHints: { label: "Assignee", widget: "text", order: 5, section: "Tracking" }
         },
         {
-          fieldId: "area",
+          fieldId: "project",
           fieldType: "string",
           filterable: true,
-          renderHints: { label: "Area", widget: "text", order: 4 }
+          description: "Grouping key for cross-session continuity.",
+          renderHints: { label: "Project", widget: "text", order: 6, section: "Tracking" }
         },
         {
-          // A gotcha can be RETIRED once the underlying trap is fixed for good —
-          // superseded, not deleted (the blueprint omits records:d).
-          fieldId: "status",
-          fieldType: "enum",
-          filterable: true,
-          enumValues: ["active", "retired"],
-          renderHints: { label: "Status", widget: "select", order: 5 }
+          fieldId: "dueDate",
+          fieldType: "date",
+          description: "ISO-8601. Range-queryable (see lookupFields) \u2014 list tasks due in a window.",
+          renderHints: { label: "Due date", widget: "date", order: 7, section: "Tracking" }
         },
         {
-          fieldId: "discoveredOn",
-          fieldType: "date",
-          description: "ISO-8601 \u2014 when this gotcha was first hit. Range-queryable.",
-          renderHints: { label: "Discovered on", widget: "date", order: 6 }
+          fieldId: "tags",
+          fieldType: "array",
+          filterable: true,
+          renderHints: { label: "Tags", order: 8, section: "Tracking" }
         }
-        // externalId: first-class identifier, not a payload field (see `decision`).
+        // externalId is the record's FIRST-CLASS identifier (the dedup/lookup key + the
+        // value a `reference` resolves against) — not a payload field; the loader sends
+        // it top-level on the RecordRequest.
       ],
-      // externalId has its own first-class finder for exact get — look it up
-      // directly, not as a schema lookup. `area`/`status` EQUALITY ("active
-      // gotchas in search"); `discoveredOn` RANGE over the discovery date.
-      lookupFields: ["area", "status", { fieldName: "discoveredOn", rangeEnabled: true }]
+      // Two lookup shapes, chosen deliberately because the equality-vs-range choice
+      // per field is MIGRATION-LOCKED once the schema is live (you cannot flip a
+      // field slot↔range later, even by removing and re-adding it):
+      //   • `project` — EQUALITY (a grouping key, not ordered): enumerate one
+      //     project's tasks directly, no search. Each equality lookup uses 1 of the
+      //     schema's 7 fast index slots.
+      //   • `dueDate` — RANGE: ordered `from`/`to`/`prefix` queries ("tasks due this
+      //     week", "due in 2026-06"). Range lookups use a relationship row, not a
+      //     slot, and are billed at the range rate. ISO-8601 sorts chronologically,
+      //     so the order is correct.
+      // `externalId` has a built-in first-class finder and must NOT be redeclared here.
+      lookupFields: ["project", { fieldName: "dueDate", rangeEnabled: true }]
     }
   ],
   // Least-privilege profile — MUST pass the CLI scope gate.
-  // r/c/u + search + schema discovery + inference:r (grounded "why did we do X?"
-  // recall over the captured rationale). NOT records:d: memory is superseded,
-  // not deleted, so the project's decision history stays auditable.
+  // r/c/u + search + schema discovery. NOT records:d (least privilege).
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"]
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for a
+    // tenant-level shared tracker — every task visible to every holder of
+    // this credential. Add a `scope:org` entry instead for per-org isolation.
+    dataScope: {}
   },
   servicePrincipal: {
-    externalId: "coding-agent-memory",
-    displayName: "Coding Agent \u2014 Project Memory"
+    externalId: "task-management",
+    displayName: "Task Management"
   },
   seed: [
     {
-      // Seeded FIRST so the convention below resolves its reference to it — the
-      // loader creates seeds in array order, and a reference target must exist when
-      // the referencing record is written.
-      surface: "record",
-      typeName: "decision",
-      externalId: "seed-use-vectros-for-memory",
-      fields: {
-        title: "Use Vectros as the coding agent\u2019s project memory",
-        statement: "Persist decisions, conventions, and gotchas as Vectros records so they survive across agent sessions.",
-        rationale: "A coding agent loses context every cold start. A governed, searchable memory lets it recall prior decisions by meaning instead of re-asking \u2014 and the version history shows how the thinking evolved.",
-        status: "active",
-        area: "getting-started",
-        decidedOn: "2026-06-14"
-      }
-    },
-    {
-      // Demonstrates a live typed link at bootstrap: this convention references the
-      // decision above by its externalId, so "open the decision behind this rule"
-      // works the moment the blueprint is applied.
       surface: "record",
-      typeName: "convention",
-      externalId: "seed-record-the-why",
+      typeName: "task",
+      externalId: "seed-welcome",
       fields: {
-        name: "Record the why, not just the what",
-        rule: "When you record a decision or convention, always capture the rationale \u2014 the trade-offs a future session cannot re-derive from the code.",
-        area: "getting-started",
-        status: "active",
-        establishedByDecision: "seed-use-vectros-for-memory",
-        adoptedOn: "2026-06-14"
+        title: "Welcome to your Vectros task tracker",
+        description: "Created by the bootstrap loader. Ask your agent to add tasks.",
+        status: "todo",
+        priority: "low",
+        project: "getting-started",
+        dueDate: "2026-06-30"
       }
     }
   ]
 };
-var coding_agent_memory_default = codingAgentMemory;
+var task_management_default = taskManagement;
 var DATA_PLANE_ACTIONS = [
   "records:r",
   "records:c",
@@ -11399,7 +12054,7 @@ var MEMBER_SHARED_READ_ACTIONS = [
 ];
 var agenticSdlc = {
   name: "agentic-sdlc",
-  version: "1.6.0",
+  version: "1.9.0",
   description: "A whole-SDLC system of record for an AI development team \u2014 decisions, designs, references, runbooks, post-mortems (as documents) plus controls, conventions, gotchas, and a glossary (as records), cross-linked and recalled by meaning.",
   contextId: "agentic-sdlc",
   contextName: "Agentic SDLC Knowledge Base",
@@ -12265,13 +12920,244 @@ var agenticSdlc = {
         { fieldName: "updatedOn", rangeEnabled: true },
         { fieldName: "priority", rangeEnabled: true }
       ]
+    },
+    {
+      // A PROPOSED memory, waiting on a verification step — the staging area in
+      // front of the `memory` type above. An agent that distills its own working
+      // sessions produces claims faster than it can check them, and an unchecked
+      // claim is worse than no claim: it is a plausible sentence that will be
+      // recalled as fact. So a proposal lands here, an agent later verifies it,
+      // and only a verified one is written to `memory`.
+      //
+      // ⚠ indexMode NONE IS THE LOAD-BEARING DECISION, not a tuning choice.
+      // Store-only means these records are never indexed, so a search or a
+      // grounded answer CANNOT return them under any query — the separation
+      // between unverified proposals and trusted knowledge is enforced by the
+      // platform rather than by every caller remembering to filter. Make this
+      // HYBRID and the corpus of unchecked claims starts competing with the
+      // curated KB for retrieval slots, which is the one failure this type
+      // exists to prevent. They stay reachable by id and by the two lookups
+      // below, which is all a disposition workflow needs.
+      //
+      // Note the consequence for the fields: `filterable` narrows SEARCH, and
+      // nothing here is searchable, so no field declares it. Query paths are the
+      // lookups, deliberately — a flag that does nothing would just read as
+      // capability that isn't there.
+      typeName: "candidate",
+      displayName: "Memory candidate",
+      indexMode: "NONE",
+      fields: [
+        {
+          fieldId: "title",
+          fieldType: "string",
+          required: true,
+          validation: { minLength: 1, maxLength: 200 },
+          description: "One line naming the claim \u2014 what a reviewer reads first.",
+          renderHints: { label: "Title", widget: "text", order: 1, displayField: true }
+        },
+        {
+          fieldId: "body",
+          fieldType: "string",
+          description: "The proposed fact in full, as the distiller stated it \u2014 the thing to verify.",
+          renderHints: { label: "Body", widget: "textarea", order: 2 }
+        },
+        {
+          // Mirrors `memory.kind` exactly, so a verified candidate maps 1:1 onto
+          // the memory it becomes with no vocabulary translation in between.
+          fieldId: "kind",
+          fieldType: "enum",
+          enumValues: ["user", "feedback", "project", "reference", "observation"],
+          description: "Which flavour of memory this would become \u2014 the same vocabulary as `memory.kind`.",
+          renderHints: { label: "Kind", widget: "select", order: 3 }
+        },
+        {
+          // The distiller's ROUTING suggestion, and the one field here with no
+          // counterpart on `memory` — because it stops existing the moment the
+          // question it asks is answered. A verified claim either becomes a
+          // memory record or becomes a paragraph in a document; this is the
+          // proposer's guess about which, and the verifier is free to overrule
+          // it (the verdict lands in `disposition`, not here).
+          fieldId: "dest",
+          fieldType: "enum",
+          enumValues: ["memory", "doc"],
+          description: "Where the proposer thinks this belongs if it survives review \u2014 a suggestion, not the verdict.",
+          renderHints: { label: "Suggested destination", widget: "select", order: 4 }
+        },
+        {
+          // `area`, `tags` and `sourceRef` below mirror `memory`'s exactly, for
+          // the same reason `kind` does: a verified candidate is COPIED into a
+          // memory, and any field that exists on only one side has to be
+          // re-derived or dropped at exactly the moment a human is deciding
+          // whether the claim is true.
+          fieldId: "area",
+          fieldType: "string",
+          description: 'Subsystem/topic the claim applies to (e.g. "auth", "search") \u2014 the shared area vocabulary.',
+          renderHints: { label: "Area", widget: "text", order: 5 }
+        },
+        {
+          fieldId: "tags",
+          fieldType: "array",
+          description: "Freeform labels carried over from the proposal.",
+          renderHints: { label: "Tags", order: 6 }
+        },
+        {
+          // Provenance the VERIFIER needs most: checking a claim starts with the
+          // file or issue it is about. A candidate whose sourceRef was dropped
+          // in transit costs the reviewer the search that the proposer had
+          // already done.
+          fieldId: "sourceRef",
+          fieldType: "string",
+          description: "Provenance: the file path / issue / URL the claim is about \u2014 where a verifier starts.",
+          renderHints: { label: "Source ref", widget: "text", order: 7 }
+        },
+        {
+          fieldId: "sessionId",
+          fieldType: "string",
+          description: "The conversation that proposed it \u2014 your runtime's session identifier.",
+          renderHints: { label: "Session", widget: "text", order: 8 }
+        },
+        {
+          // Also the stable ordering key: a display ordinal is derived by sorting
+          // on this, so proposals keep the numbering a reviewer saw. Nothing is
+          // ever hard-deleted here, which is what keeps that ordering stable.
+          fieldId: "proposedAt",
+          fieldType: "date",
+          description: "ISO-8601 \u2014 when it was proposed. Also the stable ordering key for display.",
+          renderHints: { label: "Proposed at", widget: "date", order: 9 }
+        },
+        {
+          // THE VERDICT, and deliberately a plain payload field rather than the
+          // record's own ACTIVE/ARCHIVED status. Settling a candidate is
+          // REVERSIBLE — a wrong dismissal has to be undoable — and a write-side
+          // visibility flip is the wrong tool for a reversible state: it is
+          // asynchronous, it moves the record out from under readers, and it
+          // leaves the index status of a once-indexed row stranded. A filterable
+          // payload field flips synchronously and reads the same for everyone.
+          fieldId: "disposition",
+          fieldType: "enum",
+          enumValues: ["pending", "stored", "documented", "ignored"],
+          description: "The verdict: still pending, written to memory, captured in a doc, or dismissed.",
+          renderHints: { label: "Disposition", widget: "select", order: 10 }
+        },
+        {
+          fieldId: "ref",
+          fieldType: "string",
+          description: "The citation given when settling it \u2014 the record id, document path, or reason.",
+          renderHints: { label: "Ref", widget: "text", order: 11 }
+        },
+        {
+          // What the settling step actually CHECKED, which is not always what the
+          // agent typed. Keeping both makes a bad citation auditable after the
+          // fact instead of indistinguishable from a good one.
+          fieldId: "resolved",
+          fieldType: "string",
+          description: "What was verified when it was settled \u2014 kept alongside `ref`, which is what was claimed.",
+          renderHints: { label: "Resolved", widget: "text", order: 12 }
+        },
+        {
+          fieldId: "origin",
+          fieldType: "enum",
+          enumValues: ["session", "recovered"],
+          description: "Proposed by a live session, or recovered later from one that ended without settling.",
+          renderHints: { label: "Origin", widget: "select", order: 13 }
+        },
+        {
+          fieldId: "reopenedWhy",
+          fieldType: "string",
+          description: "Why a settled candidate was reopened \u2014 the audit trail for undoing a verdict.",
+          renderHints: { label: "Reopened why", widget: "textarea", order: 14 }
+        },
+        {
+          // The forward half of a correction: this candidate restates an earlier
+          // one whose claim was wrong. Written at create, so it costs nothing.
+          fieldId: "revises",
+          fieldType: "reference",
+          targetTypeName: "candidate",
+          targetSurface: "record",
+          targetField: "externalId",
+          cardinality: "one",
+          description: "The candidate this one corrects (by externalId).",
+          renderHints: { label: "Revises", order: 15 }
+        },
+        {
+          // The reverse half, and NOT redundant: "is this still open?" has to be
+          // answerable without asking whether some OTHER record points here, and
+          // there is no reverse-reference read. So the superseded candidate is
+          // marked directly.
+          //
+          // Kept SEPARATE from `disposition` on purpose. Superseded and dismissed
+          // are different facts: a dismissal may be undone, while resurrecting a
+          // claim that a later run already corrected would re-offer the version
+          // known to be wrong. Folding both into one enum makes that distinction
+          // unrepresentable exactly when it matters.
+          fieldId: "supersededBy",
+          fieldType: "reference",
+          targetTypeName: "candidate",
+          targetSurface: "record",
+          targetField: "externalId",
+          cardinality: "one",
+          description: "The candidate that corrected this one (by externalId) \u2014 set on the older record.",
+          renderHints: { label: "Superseded by", order: 16 }
+        }
+      ],
+      // FOUR lookups, because this type is asked three genuinely different
+      // questions and one of them is a conjunction:
+      //
+      //   `disposition`            — "what is waiting ANYWHERE?" The cross-session
+      //                              review queue. Low cardinality, so its
+      //                              partitions are large; that is inherent to the
+      //                              question and the pending set is small.
+      //   `sessionId`              — "everything belonging to this conversation",
+      //                              settled candidates included.
+      //   (sessionId, disposition) — "what is still waiting IN this conversation".
+      //   `proposedAt` (range)     — worked by age: "what has been sitting
+      //                              longest", "what came in this week". A range
+      //                              read, not a filter over everything ever
+      //                              proposed.
+      //
+      // The composite earns its slot because that third question is the HOTTEST
+      // read in the system — it is what an agent is shown as it works, so it runs
+      // far more often than the queue-wide scan does. Without it the answer is the
+      // more selective single lookup plus a filter in the caller.
+      //
+      // `sessionId` LEADS, and the order is not cosmetic: the leading field
+      // becomes the partition key. Leading with `disposition` would sort every
+      // candidate ever proposed into four partitions; leading with `sessionId`
+      // gives one small partition per conversation. Order is also
+      // migration-locked, so it cannot be corrected later.
+      //
+      // A composite matches a LEADING RUN of its fields, so `(sessionId,
+      // disposition)` also answers `sessionId` alone. The plain `sessionId`
+      // lookup is kept anyway: under a partial tuple the unspecified field
+      // becomes part of the ordering, so results come back grouped by
+      // `disposition` rather than in one sequence — right for a filtered view,
+      // wrong for "this conversation's candidates, oldest first", which is the
+      // read the review surface and the queue/record agreement check both make.
+      // One declaration out of ten is a cheap price for not depending on that
+      // subtlety in the two places that must not be wrong.
+      //
+      // No `sortBy`: it defaults to the record's creation time, which is already
+      // the primary key the review queue orders by. Naming `proposedAt` instead
+      // would order by the WORKER's clock, and that is stamped when a proposal is
+      // queued rather than when it is stored — the two disagree by exactly the
+      // outage a durable queue exists to survive.
+      lookupFields: [
+        "disposition",
+        "sessionId",
+        { fieldNames: ["sessionId", "disposition"] },
+        { fieldName: "proposedAt", rangeEnabled: true }
+      ]
     }
   ],
   // Least-privilege, data-plane only. The scope of the `ssk_*` key the bootstrap
   // mints for THIS blueprint's service principal (the MCP/API runtime). See
   // DATA_PLANE_ACTIONS above for the action set + rationale.
   accessProfile: {
-    allowedActions: DATA_PLANE_ACTIONS
+    allowedActions: DATA_PLANE_ACTIONS,
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach — this service key IS the runtime's own access to the whole KB,
+    // not a multi-owner resource to isolate.
+    dataScope: {}
   },
   // A reusable `editor` role for the HUMAN owner — DISTINCT from `accessProfile`
   // (which scopes only the service-principal key). `bootstrap` provisions this
@@ -12291,7 +13177,9 @@ var agenticSdlc = {
     // which includes members' private memory — the trusted-administrator tradeoff,
     // called out in the bundled guide. Scope it down if your deployment wants
     // curator access without private-memory visibility.
-    editor: [{ allowedActions: EDITOR_ACTIONS }],
+    // dataScope: {} echoes the "deliberately UNSCOPED (whole-context)" call-out
+    // above as an explicit marker, not just prose — see it for the tradeoff.
+    editor: [{ allowedActions: EDITOR_ACTIONS, dataScope: {} }],
     // A team member (or their agent) — TWO memory tiers as two UNIONed clauses
     // (a record is accessible when ANY clause grants it; within one clause every
     // dataScope dimension must match):
@@ -12311,14 +13199,21 @@ var agenticSdlc = {
     // `vectros join agentic-sdlc --role member`; verify a binding with
     // `vectros access explain --principal me --context agentic-sdlc`.
     member: [
-      { allowedActions: MEMBER_SHARED_READ_ACTIONS },
+      // dataScope: {} echoes clause 1's own "UNSCOPED, but safe" call-out above
+      // as an explicit marker, not just prose.
+      { allowedActions: MEMBER_SHARED_READ_ACTIONS, dataScope: {} },
       {
         // `inference:r` is IN this self-scoped clause (not only clause 1) so a
         // member's `rag_ask` can ground on its OWN private memory — the read
         // grant (`records:r:memory`) and the inference capability travel in the
         // SAME clause, so grounding works regardless of cross-clause admission
         // semantics. Still self-fenced by dataScope: never another principal's.
-        allowedActions: ["records:cru:memory", "search:r", "inference:r"],
+        // `candidate` is READ-only here, unlike `memory`'s full CRU. A candidate's
+        // verdict is the output of a verification step, so it is written by the
+        // agent runtime that performed the check — a human editing the field
+        // directly would record a verdict nothing actually verified. Reading them
+        // is the point: the queue, the verdicts and the corrections are browsable.
+        allowedActions: ["records:cru:memory", "records:r:candidate", "search:r", "inference:r"],
         dataScope: { userId: ["${{ self.userId }}"] }
       }
     ]
@@ -12421,7 +13316,11 @@ var secondBrain = {
   // (so the agent can `rag_ask` a grounded, cited question over your notes). No
   // records:d: notes are archived (status → 'archived'), never deleted.
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"]
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach — this is a single personal-knowledge-base credential with one
+    // holder, not a multi-owner shared resource to isolate.
+    dataScope: {}
   },
   servicePrincipal: {
     externalId: "second-brain",
@@ -12553,7 +13452,11 @@ var clinicalIntake = {
   // reveal qualifier (the demo key literally cannot un-redact the PHI fields),
   // and NO inference:r (we never point a RAG capability at a PHI corpus here).
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"]
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach, unchanged from this demo's original intent — a real clinical
+    // deployment should scope this (e.g. `scope:org`) before handling real PHI.
+    dataScope: {}
   },
   servicePrincipal: {
     externalId: "clinical-intake",
@@ -12582,7 +13485,6 @@ var clinicalIntake = {
 var clinical_intake_default = clinicalIntake;
 var BUNDLED_BLUEPRINTS = [
   task_management_default,
-  coding_agent_memory_default,
   agentic_sdlc_default,
   second_brain_default,
   clinical_intake_default
@@ -12881,18 +13783,17 @@ async function mintBridgeToken(opts) {
     ttlSeconds = DEFAULT_BRIDGE_TTL_SECONDS,
     tenant = "live",
     useScopedToken = false,
+    contextId,
     fetchImpl = fetch
   } = opts;
   const base = apiBaseUrl.replace(/\/$/, "");
   const path4 = bridgeTokenPath(useScopedToken);
-  const url = `${base}${path4}?ttl=${encodeURIComponent(String(ttlSeconds))}&tenant=${encodeURIComponent(tenant)}`;
-  return fetchStToken(
-    url,
-    cognitoToken,
-    fetchImpl,
-    path4,
-    (status) => status === 404 && !useScopedToken ? ` (the dedicated ${CLI_BOOTSTRAP_TOKEN_PATH} endpoint may not be deployed yet \u2014 retry with --use-scoped-token for the fallback path)` : ""
-  );
+  let url = `${base}${path4}?ttl=${encodeURIComponent(String(ttlSeconds))}&tenant=${encodeURIComponent(tenant)}`;
+  if (contextId) url += `&context=${encodeURIComponent(contextId)}`;
+  return fetchStToken(url, cognitoToken, fetchImpl, path4, (status) => {
+    if (status !== 404 || useScopedToken || contextId) return "";
+    return ` (the dedicated ${CLI_BOOTSTRAP_TOKEN_PATH} endpoint may not be deployed yet \u2014 retry with --use-scoped-token for the fallback path)`;
+  });
 }
 async function mintContextToken(opts) {
   const {
@@ -13164,7 +14065,17 @@ async function resolveAuthContext(opts) {
     bearer: bridge.token,
     cognitoToken,
     baseUrl,
-    env: opts.env,
+    /**
+     * Derived from the REQUEST'S actual `baseUrl`, not echoed from `opts.env` — the two
+     * diverge whenever `VECTROS_API_BASE_URL`/`--base-url` alone selects the environment
+     * (the common shape when targeting staging without also passing `--env staging`,
+     * since `envToBaseUrl` lets an explicit override win over `opts.env`'s default). Every
+     * display surface that shows "on {env}" (blueprint-test's banner, `whoami`, etc.) reads
+     * this field, so it must reflect where the request actually went, not which hidden flag
+     * defaulted to what. `deriveEnvironment` falls through to `opts.env` only for a base URL
+     * it doesn't recognize (a non-standard override, e.g. a future custom/self-hosted host).
+     */
+    env: deriveEnvironment(baseUrl) ?? opts.env,
     identity,
     tenantId: typeof identity.tenantId === "string" ? identity.tenantId : void 0,
     tenant
@@ -13248,7 +14159,8 @@ var DATA_PLANE_ALLOWLIST = [
   "search",
   "documents",
   "folders",
-  "inference"
+  "inference",
+  "entities"
 ];
 var KNOWN_CONTROL_PLANE_RESOURCES = [
   "keys",
@@ -13257,14 +14169,36 @@ var KNOWN_CONTROL_PLANE_RESOURCES = [
   "users",
   "billing",
   "admin",
-  // Identity/compartment provisioning. The flat `orgs`/`clients` resources were
-  // folded into the generic `entities` (per-namespace) + `namespaces` surfaces,
-  // which is what the API now scopes on — so those are the current spellings a
-  // pack could name. (Cosmetic: any non-data-plane resource hard-rejects whether
-  // or not it is listed here; this list only sharpens the error message.)
-  "entities",
+  // The namespace REGISTRY (as opposed to `entities`, which creates/reads a
+  // ROW within an already-registered namespace — see the data-plane-allowlist
+  // note above). Registering a new namespace TYPE is a tenant-config action,
+  // root-key-gated regardless of any scope a token carries — genuinely
+  // control-plane, unlike per-namespace entity CRUD. (Cosmetic: any
+  // non-data-plane resource hard-rejects whether or not it is listed here;
+  // this list only sharpens the error message.)
+  //
+  // ⚠️ This bars `namespaces` as a SCOPE — no partner-authored role can ever
+  // be granted it. It does NOT bar a blueprint's own top-level `namespaces[]`
+  // FORMAT field (@vectros-ai/blueprints), which deliberately DOES write this
+  // same registry — the same "DISCRETIONARY vs UNCONDITIONAL" distinction
+  // {@link PARTIALLY_ADMITTED_OPS} draws for `entities`, applied here: the
+  // write rides `provisioning:c` (non-grantable — no partner role can ever
+  // hold it, the same bearer `keys`/`app-contexts` writes already require)
+  // and the platform confines it to the blueprint's OWN context
+  // unconditionally, never tenant-wide, so the reach is bounded to what the
+  // blueprint already provisions, never the pack's say-so alone. See
+  // `@vectros-ai/blueprints`' `namespaces[]` doc for the full design.
   "namespaces"
 ];
+var PARTIALLY_ADMITTED_OPS = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["r", "u", "d"])]
+]);
+var SELF_QUALIFIED_OPS = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["c"])]
+]);
+var UNQUALIFIABLE_WITH_ANY_TAIL = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["r"])]
+]);
 var VALID_OPS = /* @__PURE__ */ new Set(["c", "r", "u", "d"]);
 var DATA_PLANE_SET = new Set(DATA_PLANE_ALLOWLIST);
 var CONTROL_PLANE_SET = new Set(KNOWN_CONTROL_PLANE_RESOURCES);
@@ -13281,6 +14215,59 @@ ${summary}`
     this.rejected = rejected;
   }
 };
+var GRANTED_CAPABILITIES_ALLOWLIST = ["member-lifecycle"];
+var GRANTED_CAPABILITIES_SET = new Set(GRANTED_CAPABILITIES_ALLOWLIST);
+var CAPABILITIES_HINT = GRANTED_CAPABILITIES_ALLOWLIST.join("/");
+var CapabilityGateError = class extends Error {
+  rejected;
+  constructor(rejected) {
+    const summary = rejected.map((r) => `  \u2022 ${r.action}: ${r.reason}`).join("\n");
+    super(
+      `Capability gate rejected ${rejected.length} requested capability(ies); the bootstrap loader grants (${CAPABILITIES_HINT}) only and mints nothing on reject:
+${summary}`
+    );
+    this.name = "CapabilityGateError";
+    this.rejected = rejected;
+  }
+};
+function evaluateCapabilityToken(name) {
+  const token = name.trim();
+  if (token.length === 0) {
+    return { action: name, reason: "empty capability name" };
+  }
+  if (!GRANTED_CAPABILITIES_SET.has(token)) {
+    return {
+      action: name,
+      reason: `requests capability '${token}', which the bootstrap loader does not grant (${CAPABILITIES_HINT} only). A capability outside this list must be requested deliberately in the developer portal, never via the bootstrap loader`
+    };
+  }
+  return null;
+}
+function evaluateCapabilityGate(capabilities) {
+  const accepted = [];
+  const rejected = [];
+  for (const name of capabilities ?? []) {
+    const rejection = evaluateCapabilityToken(name);
+    if (rejection) {
+      rejected.push(rejection);
+    } else {
+      accepted.push(name);
+    }
+  }
+  return { ok: rejected.length === 0, accepted, rejected };
+}
+function assertCapabilityGate(capabilities) {
+  const result = evaluateCapabilityGate(capabilities);
+  if (!result.ok) {
+    throw new CapabilityGateError(result.rejected);
+  }
+}
+function firstInvalidOp(ops) {
+  for (const ch of ops) {
+    if (!VALID_OPS.has(ch)) return ch;
+  }
+  return void 0;
+}
 function evaluateScopeToken(action) {
   const token = action.trim();
   if (token.length === 0) {
@@ -13302,6 +14289,48 @@ function evaluateScopeToken(action) {
     };
   }
   if (!DATA_PLANE_SET.has(resource)) {
+    const admittedOps = PARTIALLY_ADMITTED_OPS.get(resource);
+    const selfOnlyOps = SELF_QUALIFIED_OPS.get(resource);
+    if (admittedOps || selfOnlyOps) {
+      const admittedHint = [.../* @__PURE__ */ new Set([...admittedOps ?? [], ...selfOnlyOps ?? []])].sort().join("/");
+      if (ops === "*") {
+        return {
+          action,
+          reason: `requests '${resource}:*', which includes operation(s) outside the narrow allowlist (${admittedHint}) admitted for this control-plane resource. Request only the specific operations you need`
+        };
+      }
+      const invalidOp2 = firstInvalidOp(ops);
+      if (invalidOp2) {
+        return {
+          action,
+          reason: `invalid operation character '${invalidOp2}' (valid operations are c, r, u, d, or '*')`
+        };
+      }
+      const qualifier = parts.length > 2 ? parts.slice(2).join(":") : void 0;
+      const isSelfQualified = qualifier === "self";
+      const unqualifiableOps = UNQUALIFIABLE_WITH_ANY_TAIL.get(resource);
+      for (const ch of ops) {
+        if (qualifier !== void 0 && unqualifiableOps?.has(ch)) {
+          return {
+            action,
+            reason: `requests '${resource}:${ch}' alongside a qualifier ('${qualifier}'), but the platform does not resolve a qualifier for '${ch}' on '${resource}' at all \u2014 it will reject the WHOLE entry as malformed, not just ignore the qualifier. Split into separate entries (e.g. '${resource}:${ch}' + the other op(s) with their qualifier).`
+          };
+        }
+        if (admittedOps?.has(ch)) continue;
+        if (selfOnlyOps?.has(ch)) {
+          if (isSelfQualified) continue;
+          return {
+            action,
+            reason: `requests control-plane scope '${resource}:${ch}' without the required ':self' qualifier. A bare or arbitrarily-qualified '${resource}:${ch}' is outside the narrow allowlist (${admittedHint}) admitted for this resource \u2014 only '${resource}:${ch}:self' is. That operation must otherwise be done deliberately in the developer portal, never via the bootstrap loader`
+          };
+        }
+        return {
+          action,
+          reason: `requests control-plane scope '${resource}:${ch}', which is outside the narrow allowlist (${admittedHint}) admitted for this resource. That operation must be done deliberately in the developer portal, never via the bootstrap loader`
+        };
+      }
+      return null;
+    }
     if (CONTROL_PLANE_SET.has(resource)) {
       return {
         action,
@@ -13316,13 +14345,12 @@ function evaluateScopeToken(action) {
   if (ops === "*") {
     return null;
   }
-  for (const ch of ops) {
-    if (!VALID_OPS.has(ch)) {
-      return {
-        action,
-        reason: `invalid operation character '${ch}' (valid operations are c, r, u, d, or '*')`
-      };
-    }
+  const invalidOp = firstInvalidOp(ops);
+  if (invalidOp) {
+    return {
+      action,
+      reason: `invalid operation character '${invalidOp}' (valid operations are c, r, u, d, or '*')`
+    };
   }
   return null;
 }
@@ -13345,6 +14373,16 @@ function assertScopeGate(allowedActions) {
     throw new ScopeGateError(result.rejected);
   }
 }
+function assertBlueprintGates(blueprint) {
+  assertScopeGate(blueprint.accessProfile.allowedActions);
+  assertCapabilityGate(blueprint.accessProfile.capabilities);
+  for (const clauses of Object.values(blueprint.roles ?? {})) {
+    for (const clause of clauses) {
+      assertScopeGate(clause.allowedActions);
+      assertCapabilityGate(clause.capabilities);
+    }
+  }
+}
 
 // src/machine-id.ts
 import { promises as fs } from "fs";
@@ -13449,6 +14487,68 @@ async function resolveApplyTimeIdentities(blueprint, client, log) {
 function actionOf(created) {
   return created ? "created" : "reconciled";
 }
+async function registerNamespaceIdempotently(client, contextIdForRequest, decl) {
+  const body = {
+    namespace: decl.namespace,
+    entityBacked: decl.entityBacked,
+    specificityRank: decl.specificityRank,
+    membershipRecordType: decl.membershipRecordType,
+    membershipTargetField: decl.membershipTargetField,
+    membershipLevelField: decl.membershipLevelField,
+    membershipLevels: decl.membershipLevels
+  };
+  try {
+    await client.registerNamespace({ contextId: contextIdForRequest, body });
+    return "created";
+  } catch (err) {
+    const info = extractServerError(err);
+    if (info.statusCode !== 400) throw err;
+    let existing;
+    try {
+      existing = await client.getNamespace({ namespace: decl.namespace, contextId: contextIdForRequest });
+    } catch {
+      throw err;
+    }
+    if (existing.contextId !== contextIdForRequest) throw err;
+    const mismatch = describeNamespaceMismatch(decl, existing);
+    if (mismatch) {
+      throw new Error(
+        `namespace '${decl.namespace}' is already registered with different settings than this blueprint declares (${mismatch}) \u2014 this looks like a collision with another blueprint or a manual registration, not a benign re-apply. Resolve the disagreement (or rename this blueprint's namespace) before re-applying.`
+      );
+    }
+    return "reconciled";
+  }
+}
+function describeNamespaceMismatch(decl, existing) {
+  const mismatches = [];
+  const declaredEntityBacked = decl.entityBacked ?? false;
+  const existingEntityBacked = existing.entityBacked ?? false;
+  if (declaredEntityBacked !== existingEntityBacked) {
+    mismatches.push(
+      `entityBacked: declared ${JSON.stringify(declaredEntityBacked)}, registered ${JSON.stringify(existingEntityBacked)}`
+    );
+  }
+  const fields = [
+    "specificityRank",
+    "membershipRecordType",
+    "membershipTargetField",
+    "membershipLevelField"
+  ];
+  for (const field of fields) {
+    const declared = decl[field];
+    const existingValue = existing[field];
+    if (declared === void 0 && (existingValue === void 0 || existingValue === null)) continue;
+    if (declared === existingValue) continue;
+    mismatches.push(`${field}: declared ${JSON.stringify(declared)}, registered ${JSON.stringify(existingValue)}`);
+  }
+  const declaredLevels = decl.membershipLevels;
+  const existingLevels = existing.membershipLevels;
+  const levelsDiffer = declaredLevels === void 0 ? existingLevels != null && existingLevels.length > 0 : JSON.stringify([...declaredLevels].sort()) !== JSON.stringify([...existingLevels ?? []].sort());
+  if (levelsDiffer) {
+    mismatches.push(`membershipLevels: declared ${JSON.stringify(declaredLevels)}, registered ${JSON.stringify(existingLevels)}`);
+  }
+  return mismatches.length > 0 ? mismatches.join("; ") : null;
+}
 var LostKeyError = class extends Error {
   constructor(keyName) {
     super(
@@ -13459,6 +14559,20 @@ var LostKeyError = class extends Error {
   }
   keyName;
 };
+var ExistingPrincipalNotConfirmedError = class extends Error {
+  constructor(contextId, userId, externalId) {
+    super(
+      `About to bind a NEW scoped key to a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either an intentional multi-machine setup for an integration you already own, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before a new credential is minted bound to it.`
+    );
+    this.contextId = contextId;
+    this.userId = userId;
+    this.externalId = externalId;
+    this.name = "ExistingPrincipalNotConfirmedError";
+  }
+  contextId;
+  userId;
+  externalId;
+};
 function mapEnumValues(enumValues) {
   if (!enumValues) return void 0;
   return enumValues.map((value) => ({ value }));
@@ -13533,7 +14647,8 @@ function toCapabilities(capabilities) {
 function toRoleScopeClauses(clauses) {
   return clauses.map((c) => ({
     allowed_actions: c.allowedActions,
-    data_scope: c.dataScope
+    data_scope: c.dataScope,
+    granted_capabilities: c.capabilities
   }));
 }
 var UnresolvedIdentitiesError = class extends Error {
@@ -13553,11 +14668,18 @@ function assertNoUnresolvedIdentities(blueprint) {
   }
 }
 async function runLoader(client, input) {
-  const { blueprint, tenantId, machineId, rotate = false, skipSeed = false, readExistingKey, persistMintedKey, log } = input;
-  assertScopeGate(blueprint.accessProfile.allowedActions);
-  for (const clauses of Object.values(blueprint.roles ?? {})) {
-    for (const clause of clauses) assertScopeGate(clause.allowedActions);
-  }
+  const {
+    blueprint,
+    tenantId,
+    machineId,
+    rotate = false,
+    skipSeed = false,
+    readExistingKey,
+    persistMintedKey,
+    confirmExistingPrincipal,
+    log
+  } = input;
+  assertBlueprintGates(blueprint);
   assertNoUnresolvedIdentities(blueprint);
   const ctxResp = await client.auth.createAppContext({ body: { contextId: blueprint.contextId, name: contextNameOf(blueprint) } });
   const contextAction = actionOf(ctxResp.created);
@@ -13575,7 +14697,65 @@ async function runLoader(client, input) {
   if (!userId) {
     throw new Error("Service-principal create returned no user id; cannot bind AccessProfile/key.");
   }
-  log.debug({ component: "loader", externalId: blueprint.servicePrincipal.externalId, userId }, "service principal ensured");
+  const userAction = actionOf(user.created);
+  log.debug(
+    { component: "loader", externalId: blueprint.servicePrincipal.externalId, userId, userAction },
+    "service principal ensured"
+  );
+  const localKeyForContext = await readExistingKey(blueprint.contextId);
+  const storedPrincipalId = localKeyForContext?.principalId;
+  const localKeyNamesThisPrincipal = storedPrincipalId === `usr_${userId}` || storedPrincipalId === userId;
+  if (userAction === "reconciled" && !localKeyNamesThisPrincipal) {
+    const proceed = confirmExistingPrincipal ? await confirmExistingPrincipal({
+      contextId: blueprint.contextId,
+      userId,
+      externalId: blueprint.servicePrincipal.externalId
+    }) : true;
+    if (!proceed) {
+      throw new ExistingPrincipalNotConfirmedError(blueprint.contextId, userId, blueprint.servicePrincipal.externalId);
+    }
+    log.debug(
+      { component: "loader", contextId: blueprint.contextId, userId },
+      "existing-principal collision confirmed (or unwired) \u2014 proceeding with any further write to this principal"
+    );
+  }
+  const needsContextPinnedBootstrap = (blueprint.issuers ?? []).length > 0 || (blueprint.namespaces ?? []).length > 0;
+  const ctxBootstrapClient = needsContextPinnedBootstrap ? input.remintBootstrapForContext ? await input.remintBootstrapForContext(blueprint.contextId) : client : void 0;
+  if (ctxBootstrapClient && input.remintBootstrapForContext) {
+    log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted context-pinned bootstrap client");
+  }
+  const namespaceActions = [];
+  for (const ns of blueprint.namespaces ?? []) {
+    const action = await registerNamespaceIdempotently(ctxBootstrapClient.identity, blueprint.contextId, ns);
+    namespaceActions.push({ namespace: ns.namespace, action });
+    log.debug({ component: "loader", namespace: ns.namespace, contextId: blueprint.contextId, action }, "namespace ensured");
+  }
+  const issuerActions = [];
+  for (const issuer of blueprint.issuers ?? []) {
+    const issuerResp = await ctxBootstrapClient.auth.registerIssuer({
+      issuerId: issuer.issuerId,
+      issuer: issuer.issuer,
+      jwksUri: issuer.jwksUri,
+      audience: issuer.audience,
+      contextId: issuer.contextId,
+      subClaim: issuer.subClaim,
+      emailClaim: issuer.emailClaim,
+      selfSignupPolicies: issuer.selfSignupPolicies?.map((p) => ({
+        signup_type: p.signupType,
+        role_id: p.roleId
+      }))
+    });
+    const action = actionOf(issuerResp.created);
+    issuerActions.push({ issuerId: issuer.issuerId, action });
+    if (action === "reconciled") {
+      log.warn(
+        { component: "loader", issuerId: issuer.issuerId },
+        "issuer already registered \u2014 the platform has no update-issuer endpoint, so any edited fields (jwksUri, audience, subClaim, emailClaim, selfSignupPolicies) on this apply were NOT applied to the existing registration"
+      );
+    } else {
+      log.debug({ component: "loader", issuerId: issuer.issuerId, action }, "issuer registered");
+    }
+  }
   const ctxClient = input.remintForContext ? await input.remintForContext(blueprint.contextId) : client;
   log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted per-context client");
   const schemaIds = {};
@@ -13622,7 +14802,10 @@ async function runLoader(client, input) {
         // literal JSON null, which is exactly what the platform's scope
         // matcher tests via `allowedValues.contains(null)`. The cast bridges
         // to the SDK's loosely-typed Record<string, Record<string,unknown>>.
-        data_scope: blueprint.accessProfile.dataScope
+        data_scope: blueprint.accessProfile.dataScope,
+        // Already gate-validated (assertBlueprintGates, above this function's
+        // call site) before this body is ever built.
+        granted_capabilities: blueprint.accessProfile.capabilities
       }
     ],
     // Optional identity overrides — scope values the service key STAMPS onto
@@ -13680,7 +14863,7 @@ async function runLoader(client, input) {
     keyId = keyResp.keyId ?? "";
     rawKey = keyResp.rawKey;
     if (keyId) {
-      await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: userId, revokedKeyId });
+      await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: `usr_${userId}`, revokedKeyId });
     }
     if (keyAction !== "rotated") keyAction = "created";
   } else {
@@ -13754,9 +14937,12 @@ async function runLoader(client, input) {
     keyName,
     keyAction,
     contextAction,
+    userAction,
     profileAction,
     schemaActions,
     roleActions,
+    issuerActions,
+    namespaceActions,
     rawKey,
     keyId,
     revokedKeyId,
@@ -13775,6 +14961,22 @@ function buildPlan(blueprint, opts = {}) {
     kind: "principal",
     summary: `principal '${blueprint.servicePrincipal.externalId}' (SERVICE)`
   });
+  for (const ns of blueprint.namespaces ?? []) {
+    const ownerNote = `owned by '${blueprint.contextId}'`;
+    const entityNote = ns.entityBacked ? ", entity-backed" : "";
+    const membershipNote = ns.membershipRecordType ? `, membership: ${ns.membershipRecordType}.${ns.membershipTargetField}` + (ns.membershipLevelField ? ` (levels: ${ns.membershipLevels?.join("/")})` : "") : "";
+    steps.push({
+      kind: "namespace",
+      summary: `namespace '${ns.namespace}' (${ownerNote}${entityNote}${membershipNote}) [${BLUEPRINT_FIELD_PHASES.namespaces}-token phase]`
+    });
+  }
+  for (const iss of blueprint.issuers ?? []) {
+    const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: ${iss.selfSignupPolicies.length} polic${iss.selfSignupPolicies.length === 1 ? "y" : "ies"}` : "";
+    steps.push({
+      kind: "issuer",
+      summary: `issuer '${iss.issuerId}' (${iss.issuer} \u2192 context '${iss.contextId}'${selfSignup}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
+    });
+  }
   for (const s of blueprint.schemas) {
     const lookups = toLookupDefs(s.lookupFields)?.map((l) => l.fieldNames ? `(${l.fieldNames.join("+")})` : l.fieldName) ?? [];
     const lookupNote = lookups.length ? ` lookup: [${lookups.join(", ")}]` : "";
@@ -13790,15 +14992,18 @@ function buildPlan(blueprint, opts = {}) {
   }
   const actions = blueprint.accessProfile.allowedActions;
   const scopeNote = blueprint.accessProfile.dataScope && Object.keys(blueprint.accessProfile.dataScope).length ? ` dataScope: ${Object.keys(blueprint.accessProfile.dataScope).join(", ")}` : "";
+  const capabilityNote = blueprint.accessProfile.capabilities?.length ? ` capabilities: [${blueprint.accessProfile.capabilities.join(", ")}]` : "";
   steps.push({
     kind: "profile",
-    summary: `profile scopes [${actions.join(", ")}] (data-plane \u2713)${scopeNote}`
+    summary: `profile scopes [${actions.join(", ")}] (data-plane \u2713)${scopeNote}${capabilityNote}`
   });
   for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
     const actionSet = [...new Set(clauses.flatMap((c) => c.allowedActions))];
+    const capSet = [...new Set(clauses.flatMap((c) => c.capabilities ?? []))];
+    const roleCapabilityNote = capSet.length ? `, capabilities [${capSet.join(", ")}]` : "";
     steps.push({
       kind: "role",
-      summary: `role '${roleId}' (${clauses.length} clause${clauses.length === 1 ? "" : "s"}, actions [${actionSet.join(", ")}])`
+      summary: `role '${roleId}' (${clauses.length} clause${clauses.length === 1 ? "" : "s"}, actions [${actionSet.join(", ")}]${roleCapabilityNote})`
     });
   }
   steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
@@ -13815,8 +15020,24 @@ function buildPlan(blueprint, opts = {}) {
 }
 function renderPlan(blueprint, steps) {
   const header = `  Plan for blueprint '${blueprint.name}' (v${blueprint.version}) \u2192 context '${blueprint.contextId}':`;
-  const legend = `  Apply is a non-destructive reconcile \u2014 each item is created if absent, else
-  updated in place to match. Nothing is dropped or recreated.`;
+  const legendLines = [
+    `  Apply is a non-destructive reconcile \u2014 each item is created if absent, else`,
+    `  updated in place to match. Nothing is dropped or recreated.`
+  ];
+  if (steps.some((s) => s.kind === "issuer")) {
+    legendLines.push(
+      `  Exception: issuers cannot be updated once registered \u2014 an existing`,
+      `  issuer is left unchanged, not reconciled to match.`
+    );
+  }
+  if (steps.some((s) => s.kind === "namespace")) {
+    legendLines.push(
+      `  Exception: namespace registration is not idempotent \u2014 a re-apply matching`,
+      `  an existing registration converges silently, but one that disagrees FAILS`,
+      `  the apply rather than reconciling it.`
+    );
+  }
+  const legend = legendLines.join("\n");
   const lines = steps.map((s) => `    + ${s.summary}`);
   return [header, legend, "", ...lines].join("\n");
 }
@@ -14064,6 +15285,15 @@ var OsKeychainSecretStore = class {
    * against the real Windows store on every MR — the dev-machine probe is a point
    * measurement, not a regression gate. (Tracked internally; this file ships to
    * public npm, so no tracker number here.)
+   *
+   * ⚠️ THIS METHOD'S FAIL-CLOSED GUARANTEE IS AN UPSTREAM BEHAVIOURAL CONTRACT, NOT
+   * SOMETHING THIS CODE ENFORCES. `@napi-rs/keyring` is pinned to an EXACT version
+   * in `package.json` for exactly this reason: if a future release returned `[]`
+   * from `findCredentials()` on a locked store instead of throwing, the `catch`
+   * block above would never run — `!.some(...)` on an empty array reads as "gone",
+   * `deleteSecret` returns `true`, and `remove`/`prune` drop the index row of a
+   * still-live credential. A version bump of this dependency is a security review
+   * of the paragraph above against the new release, not a routine dependency bump.
    */
   async deleteSecret(ref) {
     try {
@@ -14997,6 +16227,26 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
     const entry = await this.getActive();
     return entry ? this.readSecret(entry) : void 0;
   }
+  /**
+   * The ACTIVE entry's tenant (test/live), or undefined if there is no active
+   * entry or its tenant cannot be determined — WITHOUT migrating its secret.
+   *
+   * Deliberately NOT built on {@link resolveActiveSecret}/{@link readSecret}:
+   * both migrate the secret to this machine's preferred store as a side effect
+   * of reading it, and a caller that only wants to CLASSIFY the active identity
+   * (e.g. "is it safe to activate a different one over it?") must not silently
+   * relocate — and take the cross-process index lock for — a credential it has
+   * no other reason to touch. Same non-migrating shape {@link assess} already
+   * uses per entry (`store.getSecret` directly, never `readSecret`).
+   */
+  async activeTenant() {
+    const entry = await this.getActive();
+    if (!entry) return void 0;
+    const store = this.storeFor(entry);
+    if (!store) return void 0;
+    const secret = await store.getSecret(entry.secretRef);
+    return secret !== void 0 ? keyTenant(secret) : void 0;
+  }
   /**
    * Read one entry's secret, moving it to this machine's preferred store if it is
    * somewhere else.
@@ -15123,26 +16373,31 @@ import * as readline from "readline/promises";
 async function runKeyringList(opts, deps = {}) {
   try {
     const keyring = deps.keyring ?? await Keyring.open();
-    const entries = await keyring.list();
-    const active = await keyring.activeAlias();
     if (opts.json) {
+      const entries = await keyring.list();
+      const active = await keyring.activeAlias();
       process.stdout.write(`${formatJson({ active, entries })}
 `);
       return 0;
     }
-    if (entries.length === 0) {
+    const { health } = await assessEntries(keyring);
+    if (health.length === 0) {
       process.stdout.write("\n  (no keyring entries yet \u2014 run `vectros join <context>` to add one)\n");
       return 0;
     }
     process.stdout.write(
-      "\n" + formatTable(entries, [
-        { header: "", get: (e) => e.alias === active ? "*" : "" },
-        { header: "alias", get: (e) => e.alias },
-        { header: "context", get: (e) => e.context },
-        { header: "principal", get: (e) => e.principalId },
-        { header: "role", get: (e) => e.role },
-        { header: "env", get: (e) => e.env },
-        { header: "key id", get: (e) => e.keyId }
+      "\n" + formatTable(health, [
+        { header: "", get: (h) => h.active ? "*" : "" },
+        { header: "alias", get: (h) => h.entry.alias },
+        { header: "context", get: (h) => h.entry.context },
+        { header: "principal", get: (h) => h.entry.principalId },
+        { header: "role", get: (h) => h.entry.role },
+        // `tenant` (test/live) replaces the old `env` (staging/production) column
+        // here: env is an internal-team concern an external developer's CLI never
+        // sees, while tenant is the distinction every user routinely holds two
+        // credentials side by side over.
+        { header: "tenant", get: (h) => tenantCell(h, { upper: true }) },
+        { header: "key id", get: (h) => h.entry.keyId }
       ]) + "\n"
     );
     return 0;
@@ -15324,6 +16579,10 @@ async function assessEntries(keyring) {
     }))
   };
 }
+function tenantCell(h, opts) {
+  if (h.status !== "ok") return void 0;
+  return h.tenant ?? (opts.upper ? "UNKNOWN" : "unknown");
+}
 function describeEntry(h) {
   return `${h.entry.alias} (${h.entry.context}, ${h.entry.keyId})`;
 }
@@ -15468,9 +16727,7 @@ async function runKeyringDoctor(opts, deps = {}) {
           // `unknown` can escalate; one that sees a confident wrong answer cannot.
           store: storeKindOf(h.entry) ?? "unknown",
           secret: h.status,
-          // `unknown` rather than absent: a consumer must be able to tell "not a
-          // live key" from "we could not read the shape of this one".
-          tenant: h.status === "ok" ? h.tenant ?? "unknown" : void 0
+          tenant: tenantCell(h, { upper: false })
         })),
         liveKeys: liveKeys.map((h) => h.entry.alias),
         findings
@@ -15485,7 +16742,7 @@ async function runKeyringDoctor(opts, deps = {}) {
         { header: "", get: (h) => h.active ? "*" : "" },
         { header: "alias", get: (h) => h.entry.alias },
         { header: "context", get: (h) => h.entry.context },
-        { header: "tenant", get: (h) => h.status === "ok" ? h.tenant ?? "UNKNOWN" : void 0 },
+        { header: "tenant", get: (h) => tenantCell(h, { upper: true }) },
         { header: "key id", get: (h) => h.entry.keyId },
         { header: "secret", get: (h) => h.status === "ok" ? "ok" : h.status.toUpperCase() }
       ]) + "\n"
@@ -15671,6 +16928,55 @@ function revokeWarning(targets) {
 }
 
 // src/minted-key-store.ts
+function keyringAliasFor(alias, tenant) {
+  if (tenant === "live" && alias.endsWith(".test")) {
+    throw new Error(
+      `'${alias}' ends in the reserved '.test' suffix this CLI uses to separate tenants in the local keyring \u2014 a live-tenant request for it would collide with (and could silently overwrite) a real --tenant test entry. Choose a different alias, or pass --tenant test if that's the credential you actually mean.`
+    );
+  }
+  return tenant === "test" ? `${alias}.test` : alias;
+}
+function resolveActivateDecision(opts) {
+  if (opts.explicitActivate !== void 0) return opts.explicitActivate;
+  if (opts.tenant === "live") return true;
+  return opts.currentActiveTenant !== "live";
+}
+async function determineActivateDecision(keyring, opts) {
+  if (opts.explicitActivate !== void 0 || opts.tenant === "live") {
+    return resolveActivateDecision(opts);
+  }
+  let currentActiveTenant;
+  try {
+    if (opts.hint && opts.hint.alias === await keyring.activeAlias()) {
+      currentActiveTenant = keyTenant(opts.hint.secret);
+    } else {
+      currentActiveTenant = await keyring.activeTenant();
+    }
+  } catch {
+  }
+  return resolveActivateDecision({ ...opts, currentActiveTenant });
+}
+function tenantActivateMessage(opts) {
+  if (opts.willActivate) {
+    if (opts.tenant !== "test") return "";
+    return `
+  \u26A0 '${opts.alias}' is now your ACTIVE identity \u2014 a TEST tenant credential. Anything
+    resolving a key with no explicit --alias (including the MCP server) follows it.
+`;
+  }
+  if (opts.explicitlyDeclined) {
+    return `
+  \u26A0 Stored '${opts.alias}' (${opts.tenant} tenant) without activating it \u2014 you passed --no-activate.
+    Run \`vectros switch ${opts.alias}\` when you're ready to use it.
+`;
+  }
+  return `
+  \u26A0 Stored '${opts.alias}' (test tenant) WITHOUT activating it \u2014 your currently-active
+    identity is a LIVE credential, and switching it out from under you silently is
+    exactly the mistake this check exists to prevent. Run \`vectros switch ${opts.alias}\`
+    to use the test key, or re-run with --activate to do so automatically.
+`;
+}
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -15767,10 +17073,7 @@ async function storeMintedKey(keyring, binding, secret, opts = {}) {
 // src/cli-bootstrap.ts
 function validateBlueprint(input) {
   const blueprint = parseBlueprint(input);
-  assertScopeGate(blueprint.accessProfile.allowedActions);
-  for (const clauses of Object.values(blueprint.roles ?? {})) {
-    for (const clause of clauses) assertScopeGate(clause.allowedActions);
-  }
+  assertBlueprintGates(blueprint);
   return blueprint;
 }
 var BLANK_SLATE = {
@@ -15787,10 +17090,12 @@ var BLANK_SLATE = {
 };
 function parseBootstrapArgs(argv) {
   const args = {
+    set: [],
     env: "production",
     yes: false,
     noMerge: false,
     rotate: false,
+    confirmExistingPrincipal: false,
     useScopedToken: false,
     blankSlate: false,
     noSeed: false,
@@ -15804,6 +17109,12 @@ function parseBootstrapArgs(argv) {
       case "--blueprint":
         args.blueprint = argv[++i];
         break;
+      case "--set":
+        args.set.push(argv[++i]);
+        break;
+      case "--values":
+        args.values = argv[++i];
+        break;
       case "--env": {
         const v = argv[++i];
         if (v !== "staging" && v !== "production") {
@@ -15836,6 +17147,9 @@ function parseBootstrapArgs(argv) {
       case "--rotate":
         args.rotate = true;
         break;
+      case "--confirm-existing-principal":
+        args.confirmExistingPrincipal = true;
+        break;
       case "--use-scoped-token":
         args.useScopedToken = true;
         break;
@@ -15857,6 +17171,12 @@ function parseBootstrapArgs(argv) {
       case "--test":
         args.tenant = "test";
         break;
+      case "--activate":
+        args.activate = true;
+        break;
+      case "--no-activate":
+        args.activate = false;
+        break;
       case "--help":
       case "-h":
         args.help = true;
@@ -15874,6 +17194,26 @@ function seedDeclined(answer) {
   const a = answer.trim().toLowerCase();
   return a === "n" || a === "no";
 }
+function existingPrincipalConfirmed(answer) {
+  const a = answer.trim().toLowerCase();
+  return a === "y" || a === "yes";
+}
+function buildConfirmExistingPrincipal(args, prompt, isTty) {
+  return async (details) => {
+    if (!args.yes && isTty) {
+      const ans = await prompt(
+        `
+  \u26A0 '${details.externalId}' already exists in your tenant (context '${details.contextId}') \u2014 this key will bind to that EXISTING identity, not a new one.
+  Expected if you're re-applying a blueprint from a new machine, or setting up a second
+  credential for an integration you already own. If you don't recognize this identity,
+  do NOT proceed \u2014 this may be a name collision with something you don't control.
+  Proceed and bind to the existing identity? [y/N]: `
+      );
+      return existingPrincipalConfirmed(ans);
+    }
+    return args.confirmExistingPrincipal;
+  };
+}
 function seedSummaryLine(opts) {
   if (opts.noSeed) {
     return opts.declinedInteractively ? "  \u2714 Seeded 0 record(s) \u2014 skipped (you declined sample data)\n" : "  \u2714 Seeded 0 record(s) \u2014 skipped (--no-seed)\n";
@@ -15901,22 +17241,45 @@ function reconcileTally(items, noun) {
   if (reconciled) seg.push(`${reconciled} reconciled`);
   return `${items.length} ${noun}${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
 }
+function issuerTally(items) {
+  if (items.length === 0) return null;
+  const created = items.filter((i) => i.action === "created").length;
+  const unchanged = items.length - created;
+  const seg = [];
+  if (created) seg.push(`${created} created`);
+  if (unchanged) seg.push(`${unchanged} already registered \u2014 unchanged (issuers cannot be updated once registered)`);
+  return `${items.length} issuer${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
+}
+function namespaceTally(items) {
+  if (items.length === 0) return null;
+  const created = items.filter((i) => i.action === "created").length;
+  const matched = items.length - created;
+  const seg = [];
+  if (created) seg.push(`${created} created`);
+  if (matched) seg.push(`${matched} already registered \u2014 confirmed matching`);
+  return `${items.length} namespace${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
+}
 function applyOutcomeSummary(result) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
     reconcileTally(result.roleActions, "role"),
+    issuerTally(result.issuerActions),
+    namespaceTally(result.namespaceActions),
     `profile ${result.profileAction}`
   ].filter((p) => p !== null);
   const detail = parts.length ? ` \u2014 ${parts.join("; ")}` : "";
+  const principalNote = result.userAction === "reconciled" ? `  \u26A0 service principal already existed in this tenant before this run (not newly created)
+` : "";
   return `  \u2714 context '${result.contextId}' ${result.contextAction}${detail}
-`;
+${principalNote}`;
 }
 var BOOTSTRAP_HELP = `vectros bootstrap \u2014 provision a least-privilege MCP credential.
 
 Usage:
   vectros bootstrap [--blueprint <name> | --blank] [--no-seed]
+                    [--set name=value ...] [--values <file>]
                     [--tenant test|live | --test] [--client desktop|code]
-                    [--yes] [--no-merge] [--rotate]
+                    [--yes] [--no-merge] [--rotate] [--confirm-existing-principal]
                     [--token <t> | env VECTROS_BOOTSTRAP_TOKEN]
                     [--base-url <url>] [--use-scoped-token]
 
@@ -15924,6 +17287,10 @@ Options:
   --blueprint <name|file>  A bundled blueprint (${BLUEPRINT_NAMES.join(", ")}),
                            OR a path to your own blueprint YAML/JSON (./my.yaml) \u2014 the "copy &
                            own" path. File blueprints get the identical scope gate (no override).
+  --set name=value         Set an install-time input value (repeatable) for a file blueprint's
+                           'inputs:' block. Beats --values + the declared default. (Same flag as
+                           'vectros blueprint validate/plan'.)
+  --values <file>          A YAML/JSON map of input values. (File blueprints only.)
   --blank                  Credential only (read-only data-plane profile, no schemas).
   --no-seed                Provision the blueprint's schemas, profile and key but SKIP its
                            sample seed records \u2014 the right choice for a production context
@@ -15935,6 +17302,10 @@ Options:
                            The tenant rides the key (ssk_test_* vs ssk_live_*), so
                            the MCP/client config is otherwise identical.
   --test                   Shorthand for --tenant test.
+  --activate               Force the freshly-stored key to become your active identity, even
+                           if that would switch away from a currently-active LIVE credential
+                           (the one case --tenant test does NOT do this automatically).
+  --no-activate            Store the key without activating it, regardless of tenant.
   --base-url <url>         Override the API base URL (beats VECTROS_API_BASE_URL).
   --client <desktop|code>  MCP host to configure (default: desktop). 'desktop' merges
                            claude_desktop_config.json (also works for Cursor/Cline);
@@ -15949,6 +17320,13 @@ Options:
                            print the config snippet instead of merging it into your client's
                            config file. Not a dry run; see 'blueprint plan' for that.
   --rotate                 Revoke + re-mint THIS machine's key.
+  --confirm-existing-principal
+                           Required (with --yes, or with no TTY) to mint a NEW key bound to a
+                           service principal that already existed in your tenant before this run
+                           \u2014 e.g. a deliberate second machine for an integration you already own.
+                           Refused by default so an unexpected collision halts a CI run loudly
+                           instead of silently minting a credential bound to the wrong identity.
+                           Never needed for --rotate or an ordinary same-machine re-apply.
   --use-scoped-token       Legacy fallback.
                            NOTE: it mints a token WITHOUT the provisioning
                            capability, so it cannot create a blueprint's
@@ -15958,10 +17336,21 @@ Options:
 
 No --blueprint/--blank in a TTY \u2192 interactive menu.`;
 async function resolveBlueprint(args, prompt, isTty) {
-  if (args.blankSlate) return BLANK_SLATE;
+  if (args.blankSlate) {
+    if (args.set.length > 0 || args.values) {
+      throw new Error(`--set/--values apply only to file blueprints; --blank has no inputs to set.`);
+    }
+    return BLANK_SLATE;
+  }
   if (args.blueprint) {
     if (looksLikePath(args.blueprint)) {
-      return await loadBlueprintFile(args.blueprint);
+      const supplied = await buildInputSupply(args.set, args.values);
+      return await loadBlueprintFile(args.blueprint, supplied);
+    }
+    if (args.set.length > 0 || args.values) {
+      throw new Error(
+        `--set/--values apply only to file blueprints; '${args.blueprint}' is a bundled blueprint (no inputs to set).`
+      );
     }
     const b = getBlueprint(args.blueprint);
     if (!b) {
@@ -15974,6 +17363,11 @@ async function resolveBlueprint(args, prompt, isTty) {
   if (!isTty) {
     throw new Error("No --blueprint or --blank specified and not a TTY (cannot show the menu).");
   }
+  if (args.set.length > 0 || args.values) {
+    throw new Error(
+      `--set/--values need an explicit --blueprint <file>; the interactive menu only offers bundled blueprints and blank slate, neither of which has inputs to set.`
+    );
+  }
   const options = [
     { label: "Blank slate (credential only)", blueprint: BLANK_SLATE },
     ...BUNDLED_BLUEPRINTS.map((b) => ({ label: `${b.name} \u2014 ${b.description}`, blueprint: b }))
@@ -16020,6 +17414,22 @@ function buildRemintForContext(opts) {
     });
   };
 }
+function buildRemintBootstrapForContext(opts) {
+  const mintBridge = opts.mintBridge ?? mintBridgeToken;
+  return async (contextId) => {
+    const ctxToken = await mintBridge({
+      cognitoToken: opts.cognitoToken,
+      apiBaseUrl: opts.apiBaseUrl,
+      contextId,
+      tenant: opts.tenant,
+      useScopedToken: opts.useScopedToken
+    });
+    return new VectrosClient({
+      token: ctxToken.token,
+      environment: opts.apiBaseUrl
+    });
+  };
+}
 async function runBootstrapCli(argv, deps = {}) {
   const log = deps.log ?? createLogger2();
   let args;
@@ -16053,6 +17463,15 @@ ${BOOTSTRAP_HELP}
   \u2716 Scope gate refused blueprint '${blueprint.name}':
 `);
         for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+        process.stderr.write("  Minting nothing.\n");
+        return 2;
+      }
+      if (err instanceof CapabilityGateError) {
+        process.stderr.write(`
+  \u2716 Capability gate refused blueprint '${blueprint.name}':
+`);
+        for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
         process.stderr.write("  Minting nothing.\n");
         return 2;
@@ -16064,6 +17483,11 @@ ${BOOTSTRAP_HELP}
   Blueprint: ${blueprint.name}
   \u2714 Scope gate: [${gate.accepted.join(", ")}] \u2014 all data-plane \u2713
 `);
+    if (blueprint.accessProfile.capabilities?.length) {
+      const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
+      process.stdout.write(`  \u2714 Capability gate: [${capGate.accepted.join(", ")}] \u2014 granted \u2713
+`);
+    }
     let noSeed = args.noSeed;
     let seedDeclinedInteractively = false;
     if (shouldOfferSeedOptOut(args, blueprint, isTty)) {
@@ -16137,13 +17561,16 @@ ${renderPlan(blueprint, planSteps)}
       keyringOpenError = err;
     }
     let storedFreshInKeyring = false;
+    const lastResolvedSecret = /* @__PURE__ */ new Map();
     const readExistingKey = async (contextId) => {
       if (!keyring) return void 0;
+      const alias = keyringAliasFor(contextId, args.tenant);
       try {
-        const existing = await keyring.get(contextId);
+        const existing = await keyring.get(alias);
         if (!existing?.keyId) return void 0;
-        const rawKey = await keyring.resolveSecret(contextId);
-        return rawKey ? { keyId: existing.keyId, rawKey } : void 0;
+        const rawKey = await keyring.resolveSecret(alias);
+        lastResolvedSecret.set(alias, rawKey);
+        return rawKey ? { keyId: existing.keyId, rawKey, principalId: existing.principalId } : void 0;
       } catch {
         return void 0;
       }
@@ -16159,17 +17586,36 @@ ${renderPlan(blueprint, planSteps)}
         );
         return;
       }
+      const alias = keyringAliasFor(contextId, args.tenant);
       try {
-        warnReplacingAlias(await keyring.get(contextId), contextId, record.revokedKeyId);
+        warnReplacingAlias(await keyring.get(alias), alias, record.revokedKeyId);
+        const willActivate = await determineActivateDecision(keyring, {
+          tenant: args.tenant,
+          explicitActivate: args.activate,
+          hint: lastResolvedSecret.has(alias) ? { alias, secret: lastResolvedSecret.get(alias) } : void 0
+        });
         await storeMintedKey(
           keyring,
-          { alias: contextId, context: contextId, principalId: record.principalId, keyId: record.keyId, env: args.env },
+          {
+            alias,
+            context: contextId,
+            principalId: record.principalId,
+            keyId: record.keyId,
+            // Derived from the REQUEST's actual baseUrl, not echoed from args.env — the two
+            // diverge whenever VECTROS_API_BASE_URL/--base-url alone selected the environment.
+            // `keyring list`/`keyring doctor` display this field; a stale echo would show
+            // "env: production" next to a key this run actually minted against staging.
+            env: deriveEnvironment(baseUrl) ?? args.env
+          },
           record.rawKey,
-          { activate: true, revokedKeyId: record.revokedKeyId }
+          { activate: willActivate, revokedKeyId: record.revokedKeyId }
         );
         if (record.revokedKeyId) {
-          await warnOtherAliasesNaming(keyring, record.revokedKeyId, contextId);
+          await warnOtherAliasesNaming(keyring, record.revokedKeyId, alias);
         }
+        process.stdout.write(
+          tenantActivateMessage({ alias, tenant: args.tenant, willActivate, explicitlyDeclined: args.activate === false })
+        );
         storedFreshInKeyring = true;
       } catch (err) {
         process.stderr.write(
@@ -16190,12 +17636,20 @@ ${renderPlan(blueprint, planSteps)}
       skipSeed: noSeed,
       readExistingKey,
       persistMintedKey,
+      remintBootstrapForContext: buildRemintBootstrapForContext({
+        cognitoToken,
+        apiBaseUrl: baseUrl,
+        tenant: args.tenant,
+        useScopedToken: args.useScopedToken,
+        mintBridge
+      }),
       remintForContext: buildRemintForContext({
         cognitoToken,
         apiBaseUrl: baseUrl,
         tenant: args.tenant,
         mintContext
       }),
+      confirmExistingPrincipal: buildConfirmExistingPrincipal(args, promptCtx.prompt, isTty),
       log
     });
     process.stdout.write(
@@ -16213,7 +17667,7 @@ ${renderPlan(blueprint, planSteps)}
       );
       entry = buildVectrosServerEntry({ apiKey: result.rawKey, apiBaseUrl: baseUrl });
     } else if (storedFreshInKeyring || result.keyAction === "reused") {
-      entry = buildVectrosServerEntry({ alias: blueprint.contextId, apiBaseUrl: baseUrl });
+      entry = buildVectrosServerEntry({ alias: keyringAliasFor(blueprint.contextId, args.tenant), apiBaseUrl: baseUrl });
     } else {
       entry = buildVectrosServerEntry({ apiKey: result.rawKey, apiBaseUrl: baseUrl });
     }
@@ -16273,6 +17727,18 @@ ${codeAddHint}`);
 `);
       return 3;
     }
+    if (err instanceof ExistingPrincipalNotConfirmedError) {
+      process.stderr.write(
+        `
+  \u2716 ${err.message}
+
+  If this is expected (a re-apply, or a deliberate second machine for an integration you already own),
+  re-run with --confirm-existing-principal, or confirm interactively.
+  If you don't recognize this identity, investigate the blueprint's servicePrincipal.externalId before re-running.
+`
+      );
+      return 3;
+    }
     if (err instanceof BlueprintIdentityError || err instanceof UnresolvedIdentitiesError) {
       process.stderr.write(`
   \u2716 ${err.message}
@@ -16296,7 +17762,7 @@ ${formatCliError(err, { action: "Bootstrap failed" })}`);
 import { writeFile as writeFile2, access } from "fs/promises";
 
 // src/scope-grammar.ts
-var FORBIDDEN_SCOPE_NAMESPACES = /* @__PURE__ */ new Set([
+var FORBIDDEN_SCOPE_NAMESPACES2 = /* @__PURE__ */ new Set([
   "user",
   "record",
   "document",
@@ -16308,23 +17774,23 @@ var FORBIDDEN_SCOPE_NAMESPACES = /* @__PURE__ */ new Set([
   "versions",
   "lookup"
 ]);
-var SCOPE_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
+var SCOPE_NAMESPACE_RE2 = /^[a-z][a-z0-9_-]{1,31}$/;
 var SCOPE_NAMESPACE_MIN_LENGTH = 2;
 var SCOPE_NAMESPACE_MAX_LENGTH = 32;
-var SCOPE_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var SCOPE_VALUE_RE2 = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 var SCOPE_VALUE_MIN_LENGTH = 1;
 var SCOPE_VALUE_MAX_LENGTH = 128;
 function valueGrammarError(value) {
-  if (!SCOPE_VALUE_RE.test(value)) {
+  if (!SCOPE_VALUE_RE2.test(value)) {
     return `'${value}' is not a valid scope value \u2014 ${SCOPE_VALUE_MIN_LENGTH}-${SCOPE_VALUE_MAX_LENGTH} characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'. A value may not contain a colon.`;
   }
   return null;
 }
 function namespaceGrammarError(ns) {
-  if (FORBIDDEN_SCOPE_NAMESPACES.has(ns)) {
+  if (FORBIDDEN_SCOPE_NAMESPACES2.has(ns)) {
     return `'${ns}' is a reserved namespace and cannot be used as an ownership scope`;
   }
-  if (!SCOPE_NAMESPACE_RE.test(ns)) {
+  if (!SCOPE_NAMESPACE_RE2.test(ns)) {
     return `'${ns}' is not a valid namespace \u2014 lowercase, ${SCOPE_NAMESPACE_MIN_LENGTH}-${SCOPE_NAMESPACE_MAX_LENGTH} characters, starting with a letter and continuing with letters, digits, '_' or '-'`;
   }
   return null;
@@ -16493,6 +17959,10 @@ function lintBlueprint(bp) {
       }
     }
   }
+  {
+    const reached = ownerScopedReachWithoutDataScope(bp.accessProfile.allowedActions, ds);
+    if (reached.length > 0) findings.push(unconstrainedReachFinding("accessProfile", reached));
+  }
   for (const roleId of Object.keys(bp.roles ?? {})) {
     if (!ROLE_ID_RE.test(roleId)) {
       findings.push({
@@ -16505,6 +17975,10 @@ function lintBlueprint(bp) {
   for (const [roleId, clauses] of Object.entries(bp.roles ?? {})) {
     clauses.forEach((clause, i) => {
       const cds = clause.dataScope;
+      const reached = ownerScopedReachWithoutDataScope(clause.allowedActions, cds);
+      if (reached.length > 0) {
+        findings.push(unconstrainedReachFinding(`role '${roleId}' clause ${i}`, reached));
+      }
       if (!cds) return;
       for (const [key, values] of Object.entries(cds)) {
         for (const value of values) {
@@ -16521,6 +17995,17 @@ function lintBlueprint(bp) {
       }
     });
   }
+  for (const issuer of bp.issuers ?? []) {
+    for (const policy of issuer.selfSignupPolicies ?? []) {
+      if (!Object.prototype.hasOwnProperty.call(bp.roles ?? {}, policy.roleId)) {
+        findings.push({
+          severity: "warning",
+          rule: "self-signup-role-unknown",
+          message: `issuer '${issuer.issuerId}': selfSignupPolicies entry '${policy.signupType}' names roleId '${policy.roleId}', which this blueprint does not declare under 'roles:'. The platform accepts the registration anyway (its elevated-scope check is skipped for an as-yet-unknown role, re-checked unskippable at actual signup time) \u2014 a typo here registers clean and only surfaces when someone tries to self-signup.`
+        });
+      }
+    }
+  }
   return findings;
 }
 var ROLE_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
@@ -16546,6 +18031,25 @@ function placeholderFinding(where, key, value) {
     message: `${where}: dataScope.${key} value '${value}' is not a placeholder the platform recognizes \u2014 it will be rejected at apply. Valid: \${{ any }}, \${{ self.userId }}, \${{ self.scope.<namespace> }}, \${{ under.self.userId }}, \${{ under.self.scope.<namespace> }}. Spelling is exact and lowercase; use a plain value for a literal owner id.`
   };
 }
+var OWNER_SCOPED_RESOURCES = /* @__PURE__ */ new Set(["records", "documents", "entities"]);
+var UNCONSTRAINED_REACH_OPS = /* @__PURE__ */ new Set(["r", "u", "d"]);
+function ownerScopedReachWithoutDataScope(allowedActions, dataScope) {
+  const reached = /* @__PURE__ */ new Set();
+  for (const action of allowedActions) {
+    const [resource, ops] = action.split(":", 2);
+    if (!resource || !ops || !OWNER_SCOPED_RESOURCES.has(resource)) continue;
+    if (ops === "*" || [...ops].some((op) => UNCONSTRAINED_REACH_OPS.has(op))) reached.add(resource);
+  }
+  if (dataScope !== void 0) return [];
+  return [...reached].sort();
+}
+function unconstrainedReachFinding(where, resources) {
+  return {
+    severity: "warning",
+    rule: "datascope-absent-unconstrained-reach",
+    message: `${where}: no dataScope at all, but allowedActions grants r/u/d on ${resources.join("/")} \u2014 this reaches EVERY row of EVERY owner on ${resources.length > 1 ? "those resources" : "that resource"}, not just "your own org" or any other value you may have intended. If that's deliberate (a genuinely shared/tenant-wide resource), you can ignore this; otherwise add a dataScope entry.`
+  };
+}
 function lintPasses(findings) {
   return !findings.some((f) => f.severity === "error");
 }
@@ -16584,8 +18088,12 @@ schemas:
     lookupFields: [title]      # extra O(1) exact-match lookup indexes (max 10)
 
 accessProfile:
-  # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference).
-  # Anything else (keys/profiles/admin/*) is HARD-REJECTED \u2014 by design, no override.
+  # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference/entities),
+  # PLUS profiles:r/u/d (bounded by the platform to redistributing access you already have,
+  # never granting more) and profiles:c:self (create a profile for yourself only \u2014 the
+  # platform resolves "self" from the caller, not from anything you declare here). A bare
+  # profiles:c, or profiles:c:usr_<id> naming another principal, is HARD-REJECTED \u2014 by
+  # design, no override. Same for keys/users/admin/namespaces/*.
   # Ops: c|r|u|d, combinable (records:cru). Prefer the narrowest set (least privilege).
   allowedActions: [records:r, records:c, records:u, search:r, schemas:r]
   # dataScope binds the key to specific owners. Include null to ALSO see
@@ -16593,6 +18101,17 @@ accessProfile:
   # owners' records, not shared/seed data. Keys are userId (the principal) and
   # namespaced scopes (scope:org, scope:client, ...):
   # dataScope: { "scope:org": [<org-uuid>, null] }
+  # Left empty ({}) below \u2014 the explicit marker for "deliberately tenant-wide,
+  # every record visible" ('blueprint validate' warns on a MISSING dataScope
+  # key, but not on this one). This is a SCAFFOLD PLACEHOLDER, not a
+  # recommendation: it also grants records:c/u tenant-wide, so before this
+  # profile touches real data, replace it with a real scope (the example
+  # above) unless every owner genuinely sharing every record is what you want.
+  dataScope: {}
+  # capabilities is a SEPARATE gated dimension from allowedActions \u2014 named platform
+  # effects a resource:ops verb can't express. Only 'member-lifecycle' is admitted
+  # today; every other name is HARD-REJECTED, same posture as the scope gate above.
+  # capabilities: [member-lifecycle]
 
 servicePrincipal:
   externalId: ${name}-sp       # stable; the principal the profile + key bind to
@@ -16712,15 +18231,19 @@ async function resolveAndValidate(arg, verb, supplied) {
     return null;
   }
   try {
-    assertScopeGate(blueprint.accessProfile.allowedActions);
-    for (const clauses of Object.values(blueprint.roles ?? {})) {
-      for (const clause of clauses) assertScopeGate(clause.allowedActions);
-    }
+    assertBlueprintGates(blueprint);
   } catch (err) {
     if (err instanceof ScopeGateError) {
       process.stderr.write(`  \u2716 Scope gate rejected '${blueprint.name}':
 `);
       for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+      return null;
+    }
+    if (err instanceof CapabilityGateError) {
+      process.stderr.write(`  \u2716 Capability gate rejected '${blueprint.name}':
+`);
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
       return null;
     }
@@ -16752,9 +18275,10 @@ async function runValidate(args) {
   const blueprint = await resolveAndValidate(args.file, "validate", supplied);
   if (!blueprint) return 2;
   const gate = evaluateScopeGate(blueprint.accessProfile.allowedActions);
+  const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
   const warnCount = lintBlueprint(blueprint).length;
   process.stdout.write(
-    `  \u2714 '${blueprint.name}' is valid \u2014 structural \u2713, scope gate \u2713 [${gate.accepted.join(", ")}], lint \u2713` + (warnCount ? ` (${warnCount} warning${warnCount === 1 ? "" : "s"})` : "") + "\n"
+    `  \u2714 '${blueprint.name}' is valid \u2014 structural \u2713, scope gate \u2713 [${gate.accepted.join(", ")}]` + (capGate.accepted.length ? `, capability gate \u2713 [${capGate.accepted.join(", ")}]` : "") + `, lint \u2713` + (warnCount ? ` (${warnCount} warning${warnCount === 1 ? "" : "s"})` : "") + "\n"
   );
   return 0;
 }
@@ -17085,7 +18609,14 @@ async function resolveKeyDestination(opts, deps) {
 `);
     return 2;
   }
-  const alias = opts.alias ?? opts.context;
+  let alias;
+  try {
+    alias = keyringAliasFor(opts.alias ?? opts.context, opts.tenant ?? "live");
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
   if (opts.activate === false && await keyring.activeAlias() === alias) {
     process.stderr.write(
       `  \u2716 --no-activate cannot be used on '${alias}': it is your ACTIVE identity, and storing
@@ -17106,6 +18637,8 @@ async function storeAndReport(dest, key, auth, opts) {
     return 1;
   }
   const principalId = opts.principalId;
+  const tenant = keyTenant(key.rawKey) ?? "test";
+  const willActivate = await determineActivateDecision(dest.keyring, { tenant, explicitActivate: opts.activate });
   let entry;
   try {
     warnReplacingAlias(await dest.keyring.get(dest.alias), dest.alias, opts.revokedKeyId);
@@ -17120,7 +18653,7 @@ async function storeAndReport(dest, key, auth, opts) {
         env: auth.env
       },
       key.rawKey,
-      { activate: opts.activate !== false, revokedKeyId: opts.revokedKeyId }
+      { activate: willActivate, revokedKeyId: opts.revokedKeyId }
     ));
   } catch (err) {
     process.stderr.write(
@@ -17132,7 +18665,6 @@ async function storeAndReport(dest, key, auth, opts) {
     );
     return 1;
   }
-  const active = opts.activate !== false;
   process.stdout.write(
     `
   \u2714 Stored the new key in your ${describeEntryStoreNoun(entry)} \u2014 it was not printed.
@@ -17142,9 +18674,19 @@ async function storeAndReport(dest, key, auth, opts) {
       ["principal", entry.principalId || void 0],
       ["key id", entry.keyId],
       ["env", entry.env],
-      ["active", active ? "yes" : "no"]
-    ]) + "\n\n" + (active ? "  Anything that resolves a key through the CLI \u2014 the MCP server included \u2014 now\n  reads this one. No VECTROS_API_KEY needed.\n" : `  Not active. Run \`vectros switch ${entry.alias}\` to use it.
-`)
+      ["active", willActivate ? "yes" : "no"]
+    ]) + "\n\n" + // The plain "now active" note fires only on the activated path. When it
+    // did NOT activate, tenantActivateMessage below is the ONLY explanation —
+    // it already says to run `switch`, AND (unlike a bare "Not active") says
+    // WHY: an explicit --no-activate vs. this call's tenant-safety default.
+    // Saying both here would print two different "run switch" instructions
+    // for one outcome.
+    (willActivate ? "  Anything that resolves a key through the CLI \u2014 the MCP server included \u2014 now\n  reads this one. No VECTROS_API_KEY needed.\n" : "") + tenantActivateMessage({
+      alias: entry.alias,
+      tenant,
+      willActivate,
+      explicitlyDeclined: opts.activate === false
+    })
   );
   return 0;
 }
@@ -17365,9 +18907,25 @@ async function runKeyRotate(opts, deps = {}) {
           return 1;
         }
       }
-      const existing = (await drainPages(() => client.auth.listScopedKeys())).find(
-        (k) => matchesTuple(k, opts.context, userId, keyName)
-      );
+      const activeKeys = await drainPages(() => client.auth.listScopedKeys());
+      const existing = activeKeys.find((k) => matchesTuple(k, opts.context, userId, keyName));
+      if (!existing && keyName === DEFAULT_KEY_NAME && !opts.forceNew) {
+        const others = activeKeys.filter(
+          (k) => k.contextId === opts.context && k.userId === userId && k.status === "active"
+        );
+        if (others.length > 0) {
+          const list = others.map((k) => `      \u2022 ${k.keyId}  (name: '${k.keyName}')`).join("\n");
+          process.stderr.write(
+            `  \u2716 No active key named '${DEFAULT_KEY_NAME}' for usr_${userId} in '${opts.context}', but ${others.length} other active key(s) already exist for this principal/context \u2014 refusing to mint a second one silently, since one of these may be the key you actually meant to rotate (e.g. one \`bootstrap\` minted):
+${list}
+    If one of these is it, re-run with --name '<its name>'.
+    If you really want a new key alongside them, re-run with --force-new.
+    Nothing was revoked or minted.
+`
+          );
+          return 1;
+        }
+      }
       if (existing?.keyId) {
         await client.auth.revokeScopedKey({ keyId: existing.keyId });
         process.stdout.write(`  \u2714 Revoked prior key ${existing.keyId}
@@ -17800,7 +19358,7 @@ function isRecognizedOwnershipKey(key) {
   if (key === "userId" || key === "partnerUserId") return true;
   if (!key.startsWith("scope:")) return false;
   const ns = key.slice("scope:".length);
-  return !FORBIDDEN_SCOPE_NAMESPACES.has(ns) && SCOPE_NAMESPACE_RE.test(ns);
+  return !FORBIDDEN_SCOPE_NAMESPACES2.has(ns) && SCOPE_NAMESPACE_RE2.test(ns);
 }
 var DIM_WILDCARD = "*";
 var ANY_TOKEN_RE = /^\$\{\{\s*any\s*\}\}$/;
@@ -18547,7 +20105,24 @@ async function captureSnapshot(client, blueprint) {
   }
   return { existingSchemaTypes, existingProfilePrincipals, existingRoleIds, failed };
 }
-async function runAssertions(client, deps, blueprint, tenantId, result) {
+async function captureIssuerSnapshot(bootstrapClient) {
+  const existingIssuerIds = /* @__PURE__ */ new Set();
+  let failed = false;
+  try {
+    let startFrom;
+    for (; ; ) {
+      const page = await bootstrapClient.auth.listIssuers({ limit: SNAPSHOT_PAGE_SIZE, startFrom });
+      for (const i of page.data ?? []) if (i.issuerId) existingIssuerIds.add(i.issuerId);
+      const next = page.nextCursor;
+      if (!next) break;
+      startFrom = next;
+    }
+  } catch {
+    failed = true;
+  }
+  return { existingIssuerIds, failed };
+}
+async function runAssertions(client, bootstrapClient, deps, blueprint, tenantId, result) {
   const assertions = [];
   try {
     const ping = await deps.pingWithKey(result.rawKey);
@@ -18632,9 +20207,35 @@ async function runAssertions(client, deps, blueprint, tenantId, result) {
       }
     }
   }
+  for (const { issuerId } of result.issuerActions) {
+    try {
+      const issuer = await bootstrapClient.auth.getIssuer({ issuerId });
+      const ok = issuer.issuerId === issuerId;
+      assertions.push({
+        name: `issuer:${issuerId}`,
+        ok,
+        detail: ok ? `issuer '${issuerId}' registered + readable` : `getIssuer(${issuerId}) returned issuerId '${issuer.issuerId ?? "(none)"}'`
+      });
+    } catch (e) {
+      assertions.push({ name: `issuer:${issuerId}`, ok: false, detail: `getIssuer(${issuerId}) failed: ${errMsg(e)}` });
+    }
+  }
+  for (const { namespace } of result.namespaceActions) {
+    try {
+      const ns = await bootstrapClient.identity.getNamespace({ namespace, contextId: blueprint.contextId });
+      const ok = ns.namespace === namespace && ns.contextId === blueprint.contextId;
+      assertions.push({
+        name: `namespace:${namespace}`,
+        ok,
+        detail: ok ? `namespace '${namespace}' registered + readable in context '${blueprint.contextId}'` : `getNamespace(${namespace}) returned namespace '${ns.namespace ?? "(none)"}' in context '${ns.contextId ?? "(tenant-wide)"}', expected '${blueprint.contextId}'`
+      });
+    } catch (e) {
+      assertions.push({ name: `namespace:${namespace}`, ok: false, detail: `getNamespace(${namespace}) failed: ${errMsg(e)}` });
+    }
+  }
   return assertions;
 }
-async function runTeardown(client, blueprint, machineId, snapshot, result) {
+async function runTeardown(client, bootstrapClient, blueprint, machineId, snapshot, result) {
   const steps = [];
   const keyName = result?.keyName ?? keyNameFor(blueprint.name, machineId);
   try {
@@ -18728,10 +20329,34 @@ async function runTeardown(client, blueprint, machineId, snapshot, result) {
   for (const [typeName] of toDelete) {
     steps.push({ step: `delete schema ${typeName}`, ok: false, error: lastError.get(typeName) ?? "could not delete" });
   }
+  for (const { issuerId } of result.issuerActions) {
+    if (snapshot.failed) {
+      steps.push({ step: `delete issuer ${issuerId}`, ok: true, skipped: true, error: "skipped \u2014 pre-apply snapshot failed; cannot prove ownership" });
+      continue;
+    }
+    if (snapshot.existingIssuerIds.has(issuerId)) {
+      steps.push({ step: `delete issuer ${issuerId}`, ok: true, skipped: true, error: "skipped \u2014 pre-existed this run" });
+      continue;
+    }
+    try {
+      await bootstrapClient.auth.deleteIssuer({ issuerId });
+      steps.push({ step: `delete issuer ${issuerId}`, ok: true });
+    } catch (e) {
+      steps.push({ step: `delete issuer ${issuerId}`, ok: false, error: errMsg(e) });
+    }
+  }
+  for (const { namespace } of result.namespaceActions) {
+    steps.push({
+      step: `delete namespace ${namespace}`,
+      ok: true,
+      skipped: true,
+      error: "namespace deletion requires a root API key (sk_*) \u2014 blueprint-test never holds one; the registration is left in place"
+    });
+  }
   return steps;
 }
 async function runBlueprintHarness(client, input, deps) {
-  const { tenantId, machineId, keep = false, log, remintForContext } = input;
+  const { tenantId, machineId, keep = false, log, remintForContext, remintBootstrapForContext } = input;
   const readExistingKey = async () => void 0;
   const persistMintedKey = async () => {
   };
@@ -18741,12 +20366,15 @@ async function runBlueprintHarness(client, input, deps) {
     log
   );
   const remint = remintForContext ?? (async () => client);
-  let snapshot;
+  const remintBootstrap = remintBootstrapForContext ?? (async () => client);
+  const hasIssuers = (blueprint.issuers ?? []).length > 0;
+  const hasNamespaces = (blueprint.namespaces ?? []).length > 0;
+  let contextSnapshot;
   if (remintForContext) {
     try {
-      snapshot = await captureSnapshot(await remintForContext(blueprint.contextId), blueprint);
+      contextSnapshot = await captureSnapshot(await remintForContext(blueprint.contextId), blueprint);
     } catch (e) {
-      snapshot = {
+      contextSnapshot = {
         existingSchemaTypes: /* @__PURE__ */ new Set(),
         existingProfilePrincipals: /* @__PURE__ */ new Set(),
         existingRoleIds: /* @__PURE__ */ new Set(),
@@ -18754,15 +20382,48 @@ async function runBlueprintHarness(client, input, deps) {
       };
     }
   } else {
-    snapshot = await captureSnapshot(client, blueprint);
+    contextSnapshot = await captureSnapshot(client, blueprint);
+  }
+  let issuerSnapshot;
+  if (!hasIssuers) {
+    issuerSnapshot = { existingIssuerIds: /* @__PURE__ */ new Set(), failed: false };
+  } else if (remintBootstrapForContext) {
+    try {
+      issuerSnapshot = await captureIssuerSnapshot(await remintBootstrapForContext(blueprint.contextId));
+    } catch (e) {
+      issuerSnapshot = { existingIssuerIds: /* @__PURE__ */ new Set(), failed: !isNotFound(e) };
+    }
+  } else {
+    issuerSnapshot = await captureIssuerSnapshot(client);
   }
+  const snapshot = {
+    ...contextSnapshot,
+    existingIssuerIds: issuerSnapshot.existingIssuerIds,
+    failed: contextSnapshot.failed || issuerSnapshot.failed
+  };
   let result;
   let assertions = [];
   let applyError;
   try {
-    result = await runLoader(client, { blueprint, tenantId, machineId, readExistingKey, persistMintedKey, log, remintForContext });
+    result = await runLoader(client, {
+      blueprint,
+      tenantId,
+      machineId,
+      readExistingKey,
+      persistMintedKey,
+      log,
+      remintForContext,
+      remintBootstrapForContext
+    });
     log.debug({ component: "harness", contextId: result.contextId, keyName: result.keyName }, "applied");
-    assertions = await runAssertions(await remint(blueprint.contextId), deps, blueprint, tenantId, result);
+    assertions = await runAssertions(
+      await remint(blueprint.contextId),
+      hasIssuers || hasNamespaces ? await remintBootstrap(blueprint.contextId) : client,
+      deps,
+      blueprint,
+      tenantId,
+      result
+    );
   } catch (e) {
     applyError = errMsg(e);
     log.warn({ component: "harness", err: applyError }, "apply phase failed");
@@ -18774,7 +20435,14 @@ async function runBlueprintHarness(client, input, deps) {
       tdClient = await remint(blueprint.contextId);
     } catch {
     }
-    teardown = await runTeardown(tdClient, blueprint, machineId, snapshot, result);
+    let tdBootstrapClient = client;
+    if (hasIssuers) {
+      try {
+        tdBootstrapClient = await remintBootstrap(blueprint.contextId);
+      } catch {
+      }
+    }
+    teardown = await runTeardown(tdClient, tdBootstrapClient, blueprint, machineId, snapshot, result);
   }
   const passed = applyError === void 0 && assertions.length > 0 && assertions.every((a) => a.ok);
   return {
@@ -18848,6 +20516,13 @@ async function runBlueprintTest(fileOrName, opts, deps = {}) {
       process.stderr.write(`  \u2716 Scope gate refused blueprint:
 `);
       for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+      return 2;
+    }
+    if (err instanceof CapabilityGateError) {
+      process.stderr.write(`  \u2716 Capability gate refused blueprint:
+`);
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
       return 2;
     }
@@ -18883,9 +20558,22 @@ async function runBlueprintTest(fileOrName, opts, deps = {}) {
           environment: auth.baseUrl
         });
       };
+      const remintBootstrapForContext = async (contextId) => {
+        const ctxToken = await mintBridgeToken({
+          cognitoToken: auth.cognitoToken,
+          apiBaseUrl: auth.baseUrl,
+          contextId,
+          tenant: auth.tenant,
+          useScopedToken: opts.useScopedToken
+        });
+        return new VectrosClient({
+          token: ctxToken.token,
+          environment: auth.baseUrl
+        });
+      };
       const report = await runBlueprintHarness(
         client,
-        { blueprint, tenantId, machineId, keep: opts.keep, log, remintForContext },
+        { blueprint, tenantId, machineId, keep: opts.keep, log, remintForContext, remintBootstrapForContext },
         { pingWithKey }
       );
       if (opts.json) {
@@ -18966,7 +20654,15 @@ async function runJoin(opts, deps = {}) {
     return 2;
   }
   const context = opts.contextArg;
-  const alias = opts.alias ?? context;
+  const tenant = opts.tenant ?? "live";
+  let alias;
+  try {
+    alias = keyringAliasFor(opts.alias ?? context, tenant);
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
   let keyring;
   try {
     keyring = deps.keyring ?? await Keyring.open();
@@ -18996,8 +20692,23 @@ async function runJoin(opts, deps = {}) {
       const heldSecret = existingEntry ? await keyring.resolveSecret(alias) : void 0;
       const canReuse = existingEntry && heldSecret && existingEntry.context === context && existingEntry.principalId === principalId && existingEntry.env === auth.env;
       if (canReuse && existingEntry) {
-        await keyring.setActive(alias);
-        emitJoined(alias, context, principalId, opts.role, existingEntry.keyId, true);
+        const willActivate2 = await determineActivateDecision(keyring, {
+          tenant,
+          explicitActivate: opts.activate,
+          hint: { alias, secret: heldSecret }
+        });
+        if (willActivate2) await keyring.setActive(alias);
+        emitJoined({
+          alias,
+          context,
+          principalId,
+          role: opts.role,
+          keyId: existingEntry.keyId,
+          reused: true,
+          tenant,
+          willActivate: willActivate2,
+          explicitlyDeclined: opts.activate === false
+        });
         return 0;
       }
       warnReplacingAlias(existingEntry, alias);
@@ -19009,13 +20720,24 @@ async function runJoin(opts, deps = {}) {
         );
       }
       if (revokedKeyId) await warnOtherAliasesNaming(keyring, revokedKeyId, alias);
+      const willActivate = await determineActivateDecision(keyring, { tenant, explicitActivate: opts.activate });
       const { entry } = await storeMintedKey(
         keyring,
         { alias, context, principalId, role: opts.role, keyId: key.keyId, env: auth.env },
         key.rawKey,
-        { revokedKeyId }
+        { activate: willActivate, revokedKeyId }
       );
-      emitJoined(alias, context, principalId, opts.role, entry.keyId, false);
+      emitJoined({
+        alias,
+        context,
+        principalId,
+        role: opts.role,
+        keyId: entry.keyId,
+        reused: false,
+        tenant,
+        willActivate,
+        explicitlyDeclined: opts.activate === false
+      });
       return 0;
     } catch (err) {
       process.stderr.write(formatCliError(err, { action: "join failed" }));
@@ -19023,27 +20745,34 @@ async function runJoin(opts, deps = {}) {
     }
   });
 }
-function emitJoined(alias, context, principalId, role, keyId, reused) {
-  process.stdout.write(
-    `
-  \u2714 Joined '${context}' as ${principalId}` + (reused ? " (existing key reused)" : "") + "\n" + formatKeyValues([
-      ["alias", alias],
-      ["context", context],
-      ["principal", principalId],
-      ["role", role],
-      ["key id", keyId]
-    ]) + `
+function emitJoined(opts) {
+  const header = `
+  \u2714 Joined '${opts.context}' as ${opts.principalId}` + (opts.reused ? " (existing key reused)" : "") + "\n" + formatKeyValues([
+    ["alias", opts.alias],
+    ["context", opts.context],
+    ["principal", opts.principalId],
+    ["role", opts.role],
+    ["key id", opts.keyId]
+  ]);
+  const activationNote = opts.willActivate ? `
 
-  Now active. Use \`vectros switch ${alias}\` to return to it, \`vectros keyring show --format env\` to export the key for the MCP server.
-`
+  Now active. Use \`vectros switch ${opts.alias}\` to return to it, \`vectros keyring show --format env\` to export the key for the MCP server.
+` : "";
+  process.stdout.write(
+    header + activationNote + tenantActivateMessage({
+      alias: opts.alias,
+      tenant: opts.tenant,
+      willActivate: opts.willActivate,
+      explicitlyDeclined: opts.explicitlyDeclined
+    })
   );
 }
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.14.0" : "dev",
-  sdk: true ? "0.38.0" : "dev",
-  blueprints: true ? "0.11.0" : "dev"
+  cli: true ? "0.16.0" : "dev",
+  sdk: true ? "0.40.0" : "dev",
+  blueprints: true ? "0.13.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -19067,6 +20796,14 @@ function addCommonAuthOptions(cmd) {
     "emit machine-readable JSON instead of the human-readable view"
   );
 }
+function parseTenantFlag(raw) {
+  if (raw !== void 0 && raw !== "test" && raw !== "live") {
+    process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${raw}')
+`);
+    process.exit(2);
+  }
+  return raw;
+}
 function toCommonOptions(flags) {
   return {
     env: flags.env,
@@ -19120,7 +20857,10 @@ function buildProgram(deps = {}) {
   return program;
 }
 function registerJoinCommand(program, deps) {
-  const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (XOR --actions)").option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
+  const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (XOR --actions)").option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option(
+    "--activate",
+    "force the freshly-stored key to become your active identity, even over a currently-active LIVE credential (the one case --tenant test does NOT do automatically)"
+  ).option("--no-activate", "store the key without activating it, regardless of tenant");
   addAuthOptions(join3).action(
     async (contextArg, flags) => {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
@@ -19138,7 +20878,8 @@ function registerJoinCommand(program, deps) {
             as: flags.as,
             scope: flags.scope,
             alias: flags.alias,
-            tenant: flags.tenant
+            tenant: flags.tenant,
+            activate: flags.activate
           },
           deps
         )
@@ -19385,9 +21126,10 @@ function toKeyDestination(flags) {
 function registerKeyCommands(program, deps) {
   const key = program.command("key").description("Manage scoped API keys (ssk_*) \u2014 issue, list, revoke, rotate.");
   const issue = addKeyDestinationOptions(
-    key.command("issue").description("Mint an ssk_* for a principal that already has a profile in the context.").requiredOption("--principal <p>", "principal (usr_<id> or <id>) with an AccessProfile in the context").requiredOption("--context <c>", "app context the key operates in").option("--name <name>", "key name (idempotency tuple component)", DEFAULT_KEY_NAME).option("--label <label>", "optional principal label (surfaced in /v1/ping)")
+    key.command("issue").description("Mint an ssk_* for a principal that already has a profile in the context.").requiredOption("--principal <p>", "principal (usr_<id> or <id>) with an AccessProfile in the context").requiredOption("--context <c>", "app context the key operates in").option("--name <name>", "key name (idempotency tuple component)", DEFAULT_KEY_NAME).option("--label <label>", "optional principal label (surfaced in /v1/ping)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)")
   );
   addAuthOptions(issue).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
     process.exit(
       await runKeyIssue({
         ...toCommonOptions(flags),
@@ -19395,6 +21137,7 @@ function registerKeyCommands(program, deps) {
         context: flags.context,
         name: flags.name,
         label: flags.label,
+        tenant,
         ...toKeyDestination(flags)
       }, deps)
     );
@@ -19402,40 +21145,58 @@ function registerKeyCommands(program, deps) {
   const list = key.command("list").description("List active scoped keys in one context (default, or --context <id>); --all-contexts for every context.").option("--principal <p>", "only keys for this principal (usr_<id> or <id>)").option("--context <c>", "only keys in this context (default: the default context)").option(
     "--all-contexts",
     "list every key across ALL your contexts (owner-only) \u2014 the tenant-wide view for the key limit"
-  );
+  ).option("--tenant <tenant>", "tenant to list: 'test' or 'live' (default live; not combinable with --all-contexts)");
   addCommonAuthOptions(list).action(
     async (flags) => {
+      if (flags.allContexts && flags.tenant !== void 0) {
+        process.stderr.write("  \u2716 --tenant is not combinable with --all-contexts (which already spans both tenants).\n");
+        process.exit(2);
+      }
+      const tenant = parseTenantFlag(flags.tenant);
       process.exit(
         await runKeyList(
           {
             ...toCommonOptions(flags),
             principal: flags.principal,
             context: flags.context,
-            allContexts: Boolean(flags.allContexts)
+            allContexts: Boolean(flags.allContexts),
+            tenant
           },
           deps
         )
       );
     }
   );
-  const get = key.command("get").description("Show one key\u2019s metadata (no secret).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)");
-  addCommonAuthOptions(get).action(async (keyId, flags) => {
-    process.exit(await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context }, deps));
-  });
-  const revoke = key.command("revoke").description("Revoke a key (soft-delete; ~5 min to take effect).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)");
-  addAuthOptions(revoke).action(async (keyId, flags) => {
-    process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context }, deps));
-  });
+  const get = key.command("get").description("Show one key\u2019s metadata (no secret).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(get).action(
+    async (keyId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+    }
+  );
+  const revoke = key.command("revoke").description("Revoke a key (soft-delete; ~5 min to take effect).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)");
+  addAuthOptions(revoke).action(
+    async (keyId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+    }
+  );
   const rotate = addKeyDestinationOptions(
-    key.command("rotate").description("Revoke the matching active key and mint a fresh secret.").requiredOption("--principal <p>", "principal (usr_<id> or <id>)").requiredOption("--context <c>", "app context").option("--name <name>", "key name to rotate", DEFAULT_KEY_NAME)
+    key.command("rotate").description("Revoke the matching active key and mint a fresh secret.").requiredOption("--principal <p>", "principal (usr_<id> or <id>)").requiredOption("--context <c>", "app context").option("--name <name>", "key name to rotate", DEFAULT_KEY_NAME).option(
+      "--force-new",
+      "mint a new key even though other active keys already exist for this principal/context under a different name (bypasses the default-name-mismatch guard)"
+    ).option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)")
   );
   addAuthOptions(rotate).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
     process.exit(
       await runKeyRotate({
         ...toCommonOptions(flags),
         principal: flags.principal,
         context: flags.context,
         name: flags.name,
+        forceNew: flags.forceNew,
+        tenant,
         ...toKeyDestination(flags)
       }, deps)
     );