@vectros-ai/cli 0.15.0 → 0.16.0

package/dist/cli.js

@@ -4435,7 +4435,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope, and applies the same `identityOverrides` bounds the update endpoint documents — a scoped credential may not repoint or clear an identity value it does not itself hold). You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
+   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope, and applies the same `identityOverrides` bounds the update endpoint documents — a scoped credential may not repoint or clear an identity value it does not itself hold). The `principalId` must name a principal that already exists: a `usr_` principal must be a live user in your tenant, so create the user before granting it a profile. A `usr_` id that names no such user is rejected, and no profile is created. `key_` principals are not checked this way. You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
    *
    * @param {Vectros.CreateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5536,7 +5536,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access.
+   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access. **A token confined to a single app context sees only that context's usage**: totals, the environment split, and the `contexts` breakdown narrow to it, and the environment your context is not bound to is omitted (`null`), not zeroed. Only a token with cross-context reach sees your full account-wide totals. Two exceptions to the narrowing, since they have no per-context breakdown to narrow to: `reads.calls.used`/`reads.dataOut.bytes` (metered per account, not per context) read as `0` for a confined token rather than a narrowed figure — the corresponding overage-credit charge fields narrow correctly; and `credits.limit` stays your whole plan's ceiling, so `credits.remaining` may overstate the account's true remaining room.
    *
    * @param {Vectros.GetUsageRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5599,7 +5599,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/usage");
   }
   /**
-   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability.
+   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key sees every context.
    *
    * @param {Vectros.GetIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5657,13 +5657,14 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. Unconditional — unlike some other registry deletes on this API, this does not check for or block on any downstream reference. Any user account already created via this issuer (by a prior self-signup or accepted invite) is NOT deleted or modified, but that user can no longer obtain a NEW token this way once you deregister the issuer — every `POST /v1/auth/token/exchange` call against it will 404, with no distinction between an unknown issuer and one you just deregistered. Register a replacement issuer, or restore this one, before your users' current tokens expire if you want their access to continue uninterrupted.
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. Deactivate the affected users first if you intend to cut off their access, or register a replacement issuer before removing this one. An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
    *
    * @param {Vectros.DeleteIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5705,6 +5706,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5723,7 +5726,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. Returns a `{data, nextCursor}` envelope.
+   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only the issuers registered in that context; a root API key sees every context. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListIssuersRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5780,7 +5783,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
   }
   /**
-   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant.
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`.
    *
    * @param {Vectros.IssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5891,7 +5894,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/ping");
   }
   /**
-   * Returns the access profiles for the given principal across all of your contexts. Use this to answer questions like "which apps does this user have access to?" — for example, to build a member-access summary. Results are confined to your account. Requires the `profiles:r` scope.
+   * Returns the access profiles for the given principal. Looking up your OWN principal — or holding the `context-directory-read` capability — returns the profiles across ALL of your contexts, letting you answer questions like "which apps does this user have access to?". A context-bound credential looking up a DIFFERENT principal instead sees only that principal's profile in your credential's own context (at most one result), never across contexts it has no authority over. Results are always confined to your account. Requires the `profiles:r` scope.
    *
    * @param {Vectros.ListProfilesForPrincipalRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6170,7 +6173,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/invite/resend");
   }
   /**
-   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
+   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. If your issuer is registered against more than one app context (each via its own audience), `context_id` selects which one to target; omit it when your token's `aud` claim matches only one registered context — the common case, unaffected by this field. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
    *
    * @param {Vectros.TokenExchangeRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7712,6 +7715,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.listEntities({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         startFrom: "b3BhcXVlLWN1cnNvci1mcm9tLXRoZS1wcmV2aW91cy1wYWdl"
    *     })
    */
@@ -7721,6 +7725,7 @@ var IdentityClient = class {
   async __listEntities(request, requestOptions) {
     const {
       namespace,
+      contextId,
       userId,
       externalId,
       scope,
@@ -7735,6 +7740,7 @@ var IdentityClient = class {
       limit
     } = request;
     const _queryParams = {
+      contextId,
       userId,
       externalId,
       scope,
@@ -7793,6 +7799,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.createEntity({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         body: {
    *             externalId: "team_eng_platform"
    *         }
@@ -7802,9 +7809,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__createEntity(request, requestOptions));
   }
   async __createEntity(request, requestOptions) {
-    const { namespace, upsert, body: _body } = request;
+    const { namespace, upsert, contextId, body: _body } = request;
     const _queryParams = {
-      upsert
+      upsert,
+      contextId
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -7861,14 +7869,18 @@ var IdentityClient = class {
    * @example
    *     await client.identity.getEntity({
    *         namespace: "team",
-   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
+   *         contextId: "myapp"
    *     })
    */
   getEntity(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__getEntity(request, requestOptions));
   }
   async __getEntity(request, requestOptions) {
-    const { namespace, id } = request;
+    const { namespace, id, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7882,7 +7894,7 @@ var IdentityClient = class {
       ),
       method: "GET",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -7919,6 +7931,7 @@ var IdentityClient = class {
    *     await client.identity.updateEntity({
    *         namespace: "team",
    *         id: "id",
+   *         contextId: "myapp",
    *         body: {
    *             externalId: "team_eng_platform"
    *         }
@@ -7928,7 +7941,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__updateEntity(request, requestOptions));
   }
   async __updateEntity(request, requestOptions) {
-    const { namespace, id, body: _body } = request;
+    const { namespace, id, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7943,7 +7959,7 @@ var IdentityClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -7983,14 +7999,18 @@ var IdentityClient = class {
    * @example
    *     await client.identity.deleteEntity({
    *         namespace: "team",
-   *         id: "id"
+   *         id: "id",
+   *         contextId: "myapp"
    *     })
    */
   deleteEntity(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__deleteEntity(request, requestOptions));
   }
   async __deleteEntity(request, requestOptions) {
-    const { namespace, id } = request;
+    const { namespace, id, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8004,7 +8024,7 @@ var IdentityClient = class {
       ),
       method: "DELETE",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8047,6 +8067,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.lookupEntities({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         body: {
    *             type: "person_v1",
    *             field: "ssn"
@@ -8057,7 +8078,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__lookupEntities(request, requestOptions));
   }
   async __lookupEntities(request, requestOptions) {
-    const { namespace, body: _body } = request;
+    const { namespace, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8072,7 +8096,7 @@ var IdentityClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -8116,15 +8140,17 @@ var IdentityClient = class {
    * @example
    *     await client.identity.getEntityVersions({
    *         namespace: "team",
-   *         id: "id"
+   *         id: "id",
+   *         contextId: "myapp"
    *     })
    */
   getEntityVersions(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__getEntityVersions(request, requestOptions));
   }
   async __getEntityVersions(request, requestOptions) {
-    const { namespace, id, startFrom } = request;
+    const { namespace, id, contextId, startFrom } = request;
     const _queryParams = {
+      contextId,
       startFrom
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
@@ -8186,7 +8212,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__getNamespace(request, requestOptions));
   }
   async __getNamespace(request, requestOptions) {
-    const { namespace } = request;
+    const { namespace, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8200,7 +8229,7 @@ var IdentityClient = class {
       ),
       method: "GET",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8225,7 +8254,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces/{namespace}");
   }
   /**
-   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`, `specificityRank`) of a registered namespace. The namespace name itself is immutable. Requires a root API key. The reserved built-ins cannot be updated.
+   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`, `specificityRank`) of a registered namespace. The namespace name and its `contextId` (which row is selected) are both immutable. Requires a root API key. `org` and `client` are updatable like any other namespace — there is no reserved-built-in exception.
    *
    * @param {Vectros.UpdateNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8247,7 +8276,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__updateNamespace(request, requestOptions));
   }
   async __updateNamespace(request, requestOptions) {
-    const { namespace, body: _body } = request;
+    const { namespace, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8262,7 +8294,7 @@ var IdentityClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -8293,7 +8325,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/namespaces/{namespace}");
   }
   /**
-   * Deletes a registered scope namespace. Requires a root API key. The reserved built-ins cannot be deleted. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
+   * Deletes a registered scope namespace. Requires a root API key. `org` and `client` are deletable like any other namespace — there is no reserved-built-in exception. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
    *
    * @param {Vectros.DeleteNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8311,7 +8343,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__deleteNamespace(request, requestOptions));
   }
   async __deleteNamespace(request, requestOptions) {
-    const { namespace } = request;
+    const { namespace, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8325,7 +8360,7 @@ var IdentityClient = class {
       ),
       method: "DELETE",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8354,7 +8389,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/namespaces/{namespace}");
   }
   /**
-   * Returns the scope namespaces registered in your account, with the reserved built-ins `org` and `client` listed first. Returns a `{data, nextCursor}` envelope.
+   * Returns the scope namespaces in your account, including `org` and `client`, which are provisioned for you when the account is created. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListNamespacesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8366,10 +8401,11 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__listNamespaces(request, requestOptions));
   }
   async __listNamespaces(request = {}, requestOptions) {
-    const { startFrom, limit } = request;
+    const { startFrom, limit, contextId } = request;
     const _queryParams = {
       startFrom,
-      limit
+      limit,
+      contextId
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -8404,9 +8440,9 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces");
   }
   /**
-   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key. The reserved names `org` and `client` are built in and cannot be registered.
+   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. `org` and `client` are provisioned when your account is created, so registering either returns the already-registered error.
    *
-   * @param {Vectros.NamespaceRequest} request
+   * @param {Vectros.RegisterNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
@@ -8415,14 +8451,20 @@ var IdentityClient = class {
    *
    * @example
    *     await client.identity.registerNamespace({
-   *         namespace: "team",
-   *         specificityRank: 1500
+   *         body: {
+   *             namespace: "team",
+   *             specificityRank: 1500
+   *         }
    *     })
    */
   registerNamespace(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__registerNamespace(request, requestOptions));
   }
   async __registerNamespace(request, requestOptions) {
+    const { contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8437,9 +8479,9 @@ var IdentityClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
-      body: request,
+      body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8724,12 +8766,13 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/users/{id}");
   }
   /**
-   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope.
+   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner.
    *
    * @param {Vectros.DeleteUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8769,6 +8812,8 @@ var IdentityClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -10851,6 +10896,35 @@ var BlueprintSchemaSchema = import_zod.z.object({
     });
   }
 });
+var CAPABILITY_NAME_RE = /^[a-z][a-z0-9-]*$/;
+var GrantedCapabilitiesSchema = import_zod.z.array(import_zod.z.string().min(1)).optional().superRefine((caps, ctx) => {
+  if (!caps) return;
+  const seen = /* @__PURE__ */ new Set();
+  caps.forEach((name, i) => {
+    if (name === "") return;
+    if (name === "*") {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [i],
+        message: "'*' is not a capability \u2014 granted_capabilities has no wildcard, and a '*' in allowedActions confers zero capabilities. Name each capability explicitly."
+      });
+    } else if (!CAPABILITY_NAME_RE.test(name)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [i],
+        message: `'${name}' is not a valid capability name (expected lowercase letters, digits and hyphens, starting with a letter, and no ':' \u2014 a capability is not an action)`
+      });
+    }
+    if (seen.has(name)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [i],
+        message: `'${name}' is declared more than once`
+      });
+    }
+    seen.add(name);
+  });
+});
 var BlueprintAccessProfileSchema = import_zod.z.object({
   // Validated structurally here; the SCOPE GATE (in @vectros-ai/cli) is
   // what enforces the data-plane-only security boundary.
@@ -10882,11 +10956,31 @@ var BlueprintAccessProfileSchema = import_zod.z.object({
   // below (`lintIdentityOverrides`, placeholder-aware — see that function's
   // docstring); this `.min(1)` is only the shape-level "non-blank" guard on
   // the value, not the grammar check.
-  identityOverrides: import_zod.z.record(import_zod.z.string().min(1)).optional()
+  identityOverrides: import_zod.z.record(import_zod.z.string().min(1)).optional(),
+  // Optional capabilities granted to the blueprint's own service-principal
+  // profile. DECISION: allowed here, not role-clause-only. On the platform,
+  // an access profile's scopes are themselves a list of clauses — the exact
+  // same wire shape a role clause carries — and the loader already builds
+  // this profile as ONE such clause. Refusing `capabilities` here while
+  // allowing it on a role clause would be an asymmetry this FORMAT package
+  // has no basis to invent: nothing on the platform side distinguishes the
+  // two, and whether granting a capability to a blueprint's own service key
+  // is sound POLICY is exactly the question the CLI's scope gate exists to
+  // answer (a separate package, out of scope for this format layer) — the
+  // same posture this package already takes with `allowedActions` above.
+  //
+  // Worth naming for whoever writes that gate: this profile is a long-lived,
+  // non-human-attributable machine credential (typically stored in CI/CD
+  // secrets), not an ephemeral human session — a materially different
+  // blast-radius question from granting the same capability to a role that
+  // a person is bound to. The gate should weigh the two separately rather
+  // than reuse one policy for both.
+  capabilities: GrantedCapabilitiesSchema
 }).strict();
 var BlueprintRoleClauseSchema = import_zod.z.object({
   allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1),
-  dataScope: import_zod.z.record(import_zod.z.array(import_zod.z.union([import_zod.z.string().min(1), import_zod.z.null()]))).optional()
+  dataScope: import_zod.z.record(import_zod.z.array(import_zod.z.union([import_zod.z.string().min(1), import_zod.z.null()]))).optional(),
+  capabilities: GrantedCapabilitiesSchema
 }).strict();
 var BlueprintRolesSchema = import_zod.z.record(import_zod.z.array(BlueprintRoleClauseSchema).min(1));
 var IDENTITY_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
@@ -10924,7 +11018,7 @@ var BlueprintServicePrincipalSchema = import_zod.z.object({
 }).strict();
 var ISSUER_ID_RE = CONTEXT_ID_RE;
 var BlueprintIssuerSchema = import_zod.z.object({
-  /** Short slug identifying this issuer within your tenant. Immutable once registered. */
+  /** Short slug identifying this issuer within your account. Immutable once registered. */
   issuerId: import_zod.z.string().regex(ISSUER_ID_RE, {
     message: "issuerId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'auth0-prod')"
   }),
@@ -10939,7 +11033,12 @@ var BlueprintIssuerSchema = import_zod.z.object({
    * this as an ordinary per-API/application default).
    */
   audience: import_zod.z.string().min(1),
-  /** Which app context an exchanged token targets. Must be an existing app context. */
+  /**
+   * Which app context an exchanged token targets. **Must equal the blueprint's own
+   * `contextId`** — an issuer is a trust anchor, so a blueprint may only attach one to the
+   * context it actually provisions. One IdP account serving several contexts needs one entry
+   * per context, each in that context's own blueprint.
+   */
   contextId: import_zod.z.string().regex(CONTEXT_ID_RE, {
     message: "contextId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'casework')"
   }),
@@ -10966,6 +11065,151 @@ var BlueprintIssuerSchema = import_zod.z.object({
     }).strict()
   ).optional()
 }).strict();
+var BlueprintNamespaceSchema = import_zod.z.object({
+  /** The namespace to register — same grammar as a `scope:<namespace>` key. */
+  namespace: import_zod.z.string().min(1),
+  /**
+   * When `true`, every value in this namespace must resolve to an existing
+   * identity entity (create via `entities:c` at the in-context phase, or a
+   * declared `identities:` entry). When `false`/omitted, values are
+   * free-form strings validated by grammar only.
+   */
+  entityBacked: import_zod.z.boolean().optional(),
+  /**
+   * This namespace's position in your account's specificity order (used to
+   * break a tie when a caller holds two scope dimensions at once). Required
+   * by the platform on registration; MUST be unique across every namespace
+   * in the account, including `org` (1000) and `client` (2000) — pick a
+   * value outside that pair, and outside any other namespace this same
+   * account might register (its own, or another blueprint's).
+   */
+  specificityRank: import_zod.z.number().int().min(0).max(1e6),
+  /**
+   * Optional membership backing — declares which record type + field hold
+   * grants of THIS namespace's values. Supply together with
+   * `membershipTargetField`, or omit both. Declaring this grants nobody
+   * anything on its own: a role opts in explicitly with
+   * `${{ member.scope.<namespace> }}` in its `dataScope`.
+   */
+  membershipRecordType: import_zod.z.string().min(1).optional(),
+  /** The field on `membershipRecordType` naming the user a grant is FOR. Required alongside `membershipRecordType`. */
+  membershipTargetField: import_zod.z.string().min(1).optional(),
+  /**
+   * The field on `membershipRecordType` naming a grant's LEVEL, so the same
+   * user can hold different levels in different values of this namespace.
+   * Supply together with `membershipLevels`, or omit both for plain
+   * in-or-out membership.
+   */
+  membershipLevelField: import_zod.z.string().min(1).optional(),
+  /** The complete set of level labels this namespace allows. Required alongside `membershipLevelField`. */
+  membershipLevels: import_zod.z.array(import_zod.z.string().min(1)).optional()
+}).strict();
+var MEMBERSHIP_FIELD_NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
+function lintNamespaces(value, ctx) {
+  if (!value || typeof value !== "object" || !("namespaces" in value)) return;
+  const namespaces = value.namespaces;
+  if (!Array.isArray(namespaces)) return;
+  const rawSchemas = value.schemas;
+  const declaredSchemaTypes = new Set(
+    (Array.isArray(rawSchemas) ? rawSchemas : []).map((s) => s && typeof s === "object" && "typeName" in s ? s.typeName : void 0).filter((t) => typeof t === "string")
+  );
+  const seenNames = /* @__PURE__ */ new Set();
+  const seenRanks = /* @__PURE__ */ new Map();
+  namespaces.forEach((entry, i) => {
+    if (!entry || typeof entry !== "object") return;
+    const ns = entry;
+    const path4 = ["namespaces", i];
+    if (typeof ns.namespace === "string") {
+      const err = scopeNamespaceGrammarError(ns.namespace);
+      if (err) ctx.addIssue({ code: import_zod.z.ZodIssueCode.custom, path: [...path4, "namespace"], message: err });
+      if (seenNames.has(ns.namespace)) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: [...path4, "namespace"],
+          message: `'${ns.namespace}' is declared more than once in namespaces[]`
+        });
+      }
+      seenNames.add(ns.namespace);
+    }
+    if (typeof ns.specificityRank === "number") {
+      const prior = seenRanks.get(ns.specificityRank);
+      if (prior !== void 0) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: [...path4, "specificityRank"],
+          message: `specificityRank ${ns.specificityRank} is already used by namespaces[${prior}] \u2014 every namespace's rank must be unique`
+        });
+      }
+      seenRanks.set(ns.specificityRank, i);
+    }
+    const hasRecordType = ns.membershipRecordType !== void 0;
+    const hasTargetField = ns.membershipTargetField !== void 0;
+    if (hasRecordType !== hasTargetField) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [...path4, "membershipRecordType"],
+        message: "membershipRecordType and membershipTargetField must be declared together, or neither"
+      });
+    }
+    if (typeof ns.membershipRecordType === "string" && !declaredSchemaTypes.has(ns.membershipRecordType)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [...path4, "membershipRecordType"],
+        message: `membershipRecordType '${ns.membershipRecordType}' must name a typeName this blueprint declares in schemas[] \u2014 a namespace's membership can only resolve over a record type the blueprint itself ships, never a type that merely happens to already exist in the target context.`
+      });
+    }
+    for (const [field, value2] of [
+      ["membershipRecordType", ns.membershipRecordType],
+      ["membershipTargetField", ns.membershipTargetField],
+      ["membershipLevelField", ns.membershipLevelField]
+    ]) {
+      if (typeof value2 === "string" && !MEMBERSHIP_FIELD_NAME_RE.test(value2)) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: [...path4, field],
+          message: `${field} '${value2}' is invalid \u2014 must be 1-64 characters of letters, digits, underscores, or hyphens`
+        });
+      }
+    }
+    const hasLevelField = ns.membershipLevelField !== void 0;
+    const hasLevels = Array.isArray(ns.membershipLevels) && ns.membershipLevels.length > 0;
+    if (hasLevelField !== hasLevels) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [...path4, "membershipLevelField"],
+        message: "membershipLevelField and a non-empty membershipLevels must be declared together, or neither"
+      });
+    }
+    if ((hasLevelField || hasLevels) && !hasRecordType) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [...path4, "membershipLevelField"],
+        message: "membershipLevelField/membershipLevels require membershipRecordType + membershipTargetField too"
+      });
+    }
+    if (Array.isArray(ns.membershipLevels)) {
+      const seenLevels = /* @__PURE__ */ new Set();
+      for (const level of ns.membershipLevels) {
+        if (typeof level !== "string") continue;
+        const err = scopeNamespaceGrammarError(level);
+        if (err) {
+          ctx.addIssue({
+            code: import_zod.z.ZodIssueCode.custom,
+            path: [...path4, "membershipLevels"],
+            message: `level '${level}': ${err}`
+          });
+        } else if (seenLevels.has(level)) {
+          ctx.addIssue({
+            code: import_zod.z.ZodIssueCode.custom,
+            path: [...path4, "membershipLevels"],
+            message: `membershipLevels contains '${level}' twice`
+          });
+        }
+        seenLevels.add(level);
+      }
+    }
+  });
+}
 var SeedCommonShape = {
   /** The schema typeName this seed instantiates (should match a declared schema). */
   typeName: import_zod.z.string().min(1),
@@ -11006,7 +11250,7 @@ var BlueprintSeedRecordSchema = import_zod.z.discriminatedUnion("surface", [
   RecordSeedSchema,
   DocumentSeedSchema
 ]);
-var SELF_TOKEN_RE = /\$\{\{\s*(?:self|under)\.[^}]*?\s*\}\}/;
+var SELF_TOKEN_RE = /\$\{\{\s*(?:self|under|member)\.[^}]*?\s*\}\}/;
 function lintSelfTokenPlacement(value, ctx) {
   const walk = (node, path4, inRoleDataScope) => {
     if (typeof node === "string") {
@@ -11014,7 +11258,7 @@ function lintSelfTokenPlacement(value, ctx) {
         ctx.addIssue({
           code: import_zod.z.ZodIssueCode.custom,
           path: path4,
-          message: "'${{ self.* }}' is a runtime per-principal placeholder \u2014 it is only valid inside a roles[].dataScope value"
+          message: "'${{ self.* }}' / '${{ member.* }}' is a runtime placeholder \u2014 it is only valid inside a roles[].dataScope value"
         });
       }
       return;
@@ -11214,9 +11458,36 @@ function lintSeedSurfaces(value, ctx) {
     }
   });
 }
+function lintIdentitySurfaces(value, ctx) {
+  const bp = value;
+  if (!Array.isArray(bp.schemas)) return;
+  bp.schemas.forEach((schema, i) => {
+    if (!schema.allowedSurfaces?.includes("user")) return;
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      path: ["schemas", i, "allowedSurfaces"],
+      message: `schema '${schema.typeName}': allowedSurfaces cannot include 'user' \u2014 a user-surfaced schema is account-global and requires a root API key, which no blueprint credential ever holds, so this would fail at apply with a 403. Model the data as a 'record' scoped to the user, or as an 'entity' schema (which a blueprint CAN provision, in its own app context).`
+    });
+  });
+}
+function lintIssuerContext(value, ctx) {
+  const bp = value;
+  if (!Array.isArray(bp.issuers)) return;
+  bp.issuers.forEach((issuer, i) => {
+    if (issuer.contextId === void 0 || issuer.contextId === bp.contextId) return;
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      path: ["issuers", i, "contextId"],
+      message: `issuer '${issuer.issuerId}' targets app context '${issuer.contextId}', but this blueprint provisions '${bp.contextId}'. An issuer must target the blueprint's own context \u2014 everything else a blueprint creates does, and an issuer that points elsewhere attaches an identity provider to an app context the blueprint never mentions. Set it to '${bp.contextId}', or move this issuer into a blueprint for '${issuer.contextId}'.`
+    });
+  });
+}
 var BLUEPRINT_FIELD_PHASES = Object.freeze({
   servicePrincipal: "bootstrap",
   issuers: "bootstrap",
+  // Registration requires the platform's provisioning:c capability, which
+  // only the bootstrap credential carries — same reasoning as issuers.
+  namespaces: "bootstrap",
   schemas: "in-context",
   accessProfile: "in-context",
   roles: "in-context",
@@ -11247,7 +11518,16 @@ var BlueprintSchema = import_zod.z.object({
    * service-principal creation — NOT the in-context load (see
    * {@link BlueprintIssuerSchema}).
    */
-  issuers: import_zod.z.array(BlueprintIssuerSchema).optional()
+  issuers: import_zod.z.array(BlueprintIssuerSchema).optional(),
+  /**
+   * Optional namespaces to register before anything else needs them — see
+   * {@link BlueprintNamespaceSchema}. Applied in the BOOTSTRAP-token phase,
+   * alongside app-context/service-principal creation and issuers, BEFORE
+   * schemas/seed (an `entityBacked` namespace's entities, and an
+   * `allowedSurfaces: ['entity']` schema, both need the registration to
+   * already exist). `org`/`client` need no entry — they exist already.
+   */
+  namespaces: import_zod.z.array(BlueprintNamespaceSchema).optional()
 }).strict().superRefine((bp, ctx) => {
   lintSelfTokenPlacement(bp, ctx);
   lintIdentityRefs(bp, ctx);
@@ -11255,6 +11535,9 @@ var BlueprintSchema = import_zod.z.object({
   lintNamespacedScopeArrays(bp, ctx);
   lintDataScopeKeys(bp, ctx);
   lintSeedSurfaces(bp, ctx);
+  lintIdentitySurfaces(bp, ctx);
+  lintIssuerContext(bp, ctx);
+  lintNamespaces(bp, ctx);
 });
 function formatIssuePath(path4) {
   let out = "";
@@ -11409,9 +11692,11 @@ function deriveSuffix(contextId) {
 var WHOLE_TOKEN_RE = /^\$\{\{\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*\}\}$/;
 var TOKEN_SCAN_RE = /\$\$\{\{|\$\{\{([\s\S]*?)\}\}|\$\{\{/g;
 var INNER_REF_RE = /^([A-Za-z_]\w*)\.([A-Za-z_]\w*)$/;
-var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under"]);
+var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under", "member"]);
 var DEFERRED_NS_ALTERNATION = [...DEFERRED_NAMESPACES].join("|");
-var DEFERRED_INNER_RE = new RegExp(`^(?:${DEFERRED_NS_ALTERNATION})(?:\\.[A-Za-z_]\\w*)+$`);
+var DEFERRED_INNER_RE = new RegExp(
+  `^(?:${DEFERRED_NS_ALTERNATION})(?:\\.[A-Za-z_]\\w*)+(?::[A-Za-z_]\\w*)?$`
+);
 function resolveRef(ns, name, ctx, path4) {
   if (ns === "inputs") {
     if (!(name in ctx.declared)) {
@@ -11710,9 +11995,11 @@ var taskManagement = {
   // Least-privilege profile — MUST pass the CLI scope gate.
   // r/c/u + search + schema discovery. NOT records:d (least privilege).
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"]
-    // dataScope omitted → tenant-level shared tracker. Add a `scope:org`
-    // entry for per-org isolation.
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for a
+    // tenant-level shared tracker — every task visible to every holder of
+    // this credential. Add a `scope:org` entry instead for per-org isolation.
+    dataScope: {}
   },
   servicePrincipal: {
     externalId: "task-management",
@@ -11735,250 +12022,6 @@ var taskManagement = {
   ]
 };
 var task_management_default = taskManagement;
-var codingAgentMemory = {
-  name: "coding-agent-memory",
-  version: "1.0.0",
-  description: "Persistent project memory for a coding agent \u2014 decisions, conventions, and gotchas that survive across sessions.",
-  contextId: "coding-memory",
-  contextName: "Coding Agent \u2014 Project Memory",
-  schemas: [
-    {
-      // A durable architectural/product decision: what was decided, and WHY.
-      // The rationale is the high-value, RAG-able body — "why did we do X?"
-      // is the question a cold-context agent most needs answered.
-      typeName: "decision",
-      displayName: "Decision",
-      indexMode: "HYBRID",
-      // keyword on titles + semantic on statement/rationale
-      fields: [
-        {
-          fieldId: "title",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 200 },
-          renderHints: { label: "Title", widget: "text", order: 1, displayField: true }
-        },
-        {
-          fieldId: "statement",
-          fieldType: "string",
-          searchable: true,
-          description: "What was decided, in one or two sentences.",
-          renderHints: { label: "Statement", widget: "textarea", order: 2 }
-        },
-        {
-          fieldId: "rationale",
-          fieldType: "string",
-          searchable: true,
-          description: "Why \u2014 the trade-offs and the context. The most-recalled field.",
-          renderHints: { label: "Rationale", widget: "textarea", order: 3 }
-        },
-        {
-          fieldId: "status",
-          fieldType: "enum",
-          filterable: true,
-          enumValues: ["proposed", "active", "superseded"],
-          renderHints: { label: "Status", widget: "select", order: 4 }
-        },
-        {
-          fieldId: "area",
-          fieldType: "string",
-          filterable: true,
-          description: 'Subsystem / module the decision applies to (e.g. "auth", "search").',
-          renderHints: { label: "Area", widget: "text", order: 5 }
-        },
-        {
-          fieldId: "decidedOn",
-          fieldType: "date",
-          description: 'ISO-8601 date. Range-queryable \u2014 "decisions made this quarter".',
-          renderHints: { label: "Decided on", widget: "date", order: 6 }
-        }
-        // externalId is the record's FIRST-CLASS identifier (the dedup/upsert key + the
-        // value a `reference` resolves against) — it is NOT a payload field, so it is not
-        // declared here; the loader sends it top-level on the RecordRequest.
-      ],
-      // `externalId` is a first-class identifier with its own finder (exact
-      // get/upsert) — look it up directly, never redeclare it as a schema lookup.
-      // The choice below is MIGRATION-LOCKED once the schema is live:
-      //   • `area`/`status` — EQUALITY (categorical): "list active decisions",
-      //     "all decisions in the auth area". 2 of the 7 fast index slots.
-      //   • `decidedOn` — RANGE: ordered `from`/`to`/`prefix` over the date.
-      lookupFields: ["area", "status", { fieldName: "decidedOn", rangeEnabled: true }]
-    },
-    {
-      // A coding convention the team follows — the agent reads these before it
-      // writes code so it matches the surrounding style instead of inventing one.
-      typeName: "convention",
-      displayName: "Convention",
-      indexMode: "HYBRID",
-      fields: [
-        {
-          fieldId: "name",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 200 },
-          renderHints: { label: "Name", widget: "text", order: 1, displayField: true }
-        },
-        {
-          fieldId: "rule",
-          fieldType: "string",
-          searchable: true,
-          description: "The convention itself, stated as an imperative.",
-          renderHints: { label: "Rule", widget: "textarea", order: 2 }
-        },
-        {
-          fieldId: "area",
-          fieldType: "string",
-          filterable: true,
-          renderHints: { label: "Area", widget: "text", order: 3 }
-        },
-        {
-          // Parallels `decision.status` so a convention can be RETIRED rather than
-          // deleted (the blueprint omits records:d — memory is superseded, not lost).
-          fieldId: "status",
-          fieldType: "enum",
-          filterable: true,
-          enumValues: ["active", "retired"],
-          renderHints: { label: "Status", widget: "select", order: 4 }
-        },
-        {
-          // A typed REFERENCE to the decision that established this convention — a
-          // foreign-key link between record types (the knowledge-graph edge). The
-          // platform requires both the target type AND its surface; the value is the
-          // target decision's externalId (the default `targetField`). Provenance:
-          // "why does this convention exist? → open the decision behind it." Not
-          // searchable (a foreign-key id is search noise); declared as an equality
-          // lookup below so you can also enumerate "conventions from decision X".
-          fieldId: "establishedByDecision",
-          fieldType: "reference",
-          targetTypeName: "decision",
-          targetSurface: "record",
-          targetField: "externalId",
-          cardinality: "one",
-          renderHints: { label: "Established by (decision)", order: 5 }
-        },
-        {
-          fieldId: "adoptedOn",
-          fieldType: "date",
-          description: "ISO-8601 \u2014 when this convention was adopted. Range-queryable.",
-          renderHints: { label: "Adopted on", widget: "date", order: 6 }
-        }
-        // externalId: first-class identifier, not a payload field (see `decision`).
-      ],
-      // externalId has its own first-class finder for exact get — look it up
-      // directly, not as a schema lookup. Locked equality-vs-range choices:
-      //   • `area`/`status` — EQUALITY: "active conventions for auth".
-      //   • `establishedByDecision` — EQUALITY on the reference value: enumerate
-      //     "conventions established by decision X" (a forward link query; the
-      //     platform has no reverse-reference index on this surface).
-      //   • `adoptedOn` — RANGE over the adoption date.
-      // 3 equality lookups (of 7 fast slots) + 1 range row.
-      lookupFields: ["area", "status", "establishedByDecision", { fieldName: "adoptedOn", rangeEnabled: true }]
-    },
-    {
-      // A gotcha / sharp edge: a symptom, its cause, and the fix. Saves the
-      // agent (and the human) from re-discovering the same trap.
-      typeName: "gotcha",
-      displayName: "Gotcha",
-      indexMode: "HYBRID",
-      fields: [
-        {
-          fieldId: "symptom",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 500 },
-          renderHints: { label: "Symptom", widget: "textarea", order: 1, displayField: true }
-        },
-        {
-          fieldId: "cause",
-          fieldType: "string",
-          searchable: true,
-          renderHints: { label: "Cause", widget: "textarea", order: 2 }
-        },
-        {
-          fieldId: "fix",
-          fieldType: "string",
-          searchable: true,
-          renderHints: { label: "Fix", widget: "textarea", order: 3 }
-        },
-        {
-          fieldId: "area",
-          fieldType: "string",
-          filterable: true,
-          renderHints: { label: "Area", widget: "text", order: 4 }
-        },
-        {
-          // A gotcha can be RETIRED once the underlying trap is fixed for good —
-          // superseded, not deleted (the blueprint omits records:d).
-          fieldId: "status",
-          fieldType: "enum",
-          filterable: true,
-          enumValues: ["active", "retired"],
-          renderHints: { label: "Status", widget: "select", order: 5 }
-        },
-        {
-          fieldId: "discoveredOn",
-          fieldType: "date",
-          description: "ISO-8601 \u2014 when this gotcha was first hit. Range-queryable.",
-          renderHints: { label: "Discovered on", widget: "date", order: 6 }
-        }
-        // externalId: first-class identifier, not a payload field (see `decision`).
-      ],
-      // externalId has its own first-class finder for exact get — look it up
-      // directly, not as a schema lookup. `area`/`status` EQUALITY ("active
-      // gotchas in search"); `discoveredOn` RANGE over the discovery date.
-      lookupFields: ["area", "status", { fieldName: "discoveredOn", rangeEnabled: true }]
-    }
-  ],
-  // Least-privilege profile — MUST pass the CLI scope gate.
-  // r/c/u + search + schema discovery + inference:r (grounded "why did we do X?"
-  // recall over the captured rationale). NOT records:d: memory is superseded,
-  // not deleted, so the project's decision history stays auditable.
-  accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"]
-  },
-  servicePrincipal: {
-    externalId: "coding-agent-memory",
-    displayName: "Coding Agent \u2014 Project Memory"
-  },
-  seed: [
-    {
-      // Seeded FIRST so the convention below resolves its reference to it — the
-      // loader creates seeds in array order, and a reference target must exist when
-      // the referencing record is written.
-      surface: "record",
-      typeName: "decision",
-      externalId: "seed-use-vectros-for-memory",
-      fields: {
-        title: "Use Vectros as the coding agent\u2019s project memory",
-        statement: "Persist decisions, conventions, and gotchas as Vectros records so they survive across agent sessions.",
-        rationale: "A coding agent loses context every cold start. A governed, searchable memory lets it recall prior decisions by meaning instead of re-asking \u2014 and the version history shows how the thinking evolved.",
-        status: "active",
-        area: "getting-started",
-        decidedOn: "2026-06-14"
-      }
-    },
-    {
-      // Demonstrates a live typed link at bootstrap: this convention references the
-      // decision above by its externalId, so "open the decision behind this rule"
-      // works the moment the blueprint is applied.
-      surface: "record",
-      typeName: "convention",
-      externalId: "seed-record-the-why",
-      fields: {
-        name: "Record the why, not just the what",
-        rule: "When you record a decision or convention, always capture the rationale \u2014 the trade-offs a future session cannot re-derive from the code.",
-        area: "getting-started",
-        status: "active",
-        establishedByDecision: "seed-use-vectros-for-memory",
-        adoptedOn: "2026-06-14"
-      }
-    }
-  ]
-};
-var coding_agent_memory_default = codingAgentMemory;
 var DATA_PLANE_ACTIONS = [
   "records:r",
   "records:c",
@@ -13105,7 +13148,11 @@ var agenticSdlc = {
   // mints for THIS blueprint's service principal (the MCP/API runtime). See
   // DATA_PLANE_ACTIONS above for the action set + rationale.
   accessProfile: {
-    allowedActions: DATA_PLANE_ACTIONS
+    allowedActions: DATA_PLANE_ACTIONS,
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach — this service key IS the runtime's own access to the whole KB,
+    // not a multi-owner resource to isolate.
+    dataScope: {}
   },
   // A reusable `editor` role for the HUMAN owner — DISTINCT from `accessProfile`
   // (which scopes only the service-principal key). `bootstrap` provisions this
@@ -13125,7 +13172,9 @@ var agenticSdlc = {
     // which includes members' private memory — the trusted-administrator tradeoff,
     // called out in the bundled guide. Scope it down if your deployment wants
     // curator access without private-memory visibility.
-    editor: [{ allowedActions: EDITOR_ACTIONS }],
+    // dataScope: {} echoes the "deliberately UNSCOPED (whole-context)" call-out
+    // above as an explicit marker, not just prose — see it for the tradeoff.
+    editor: [{ allowedActions: EDITOR_ACTIONS, dataScope: {} }],
     // A team member (or their agent) — TWO memory tiers as two UNIONed clauses
     // (a record is accessible when ANY clause grants it; within one clause every
     // dataScope dimension must match):
@@ -13145,7 +13194,9 @@ var agenticSdlc = {
     // `vectros join agentic-sdlc --role member`; verify a binding with
     // `vectros access explain --principal me --context agentic-sdlc`.
     member: [
-      { allowedActions: MEMBER_SHARED_READ_ACTIONS },
+      // dataScope: {} echoes clause 1's own "UNSCOPED, but safe" call-out above
+      // as an explicit marker, not just prose.
+      { allowedActions: MEMBER_SHARED_READ_ACTIONS, dataScope: {} },
       {
         // `inference:r` is IN this self-scoped clause (not only clause 1) so a
         // member's `rag_ask` can ground on its OWN private memory — the read
@@ -13260,7 +13311,11 @@ var secondBrain = {
   // (so the agent can `rag_ask` a grounded, cited question over your notes). No
   // records:d: notes are archived (status → 'archived'), never deleted.
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"]
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach — this is a single personal-knowledge-base credential with one
+    // holder, not a multi-owner shared resource to isolate.
+    dataScope: {}
   },
   servicePrincipal: {
     externalId: "second-brain",
@@ -13392,7 +13447,11 @@ var clinicalIntake = {
   // reveal qualifier (the demo key literally cannot un-redact the PHI fields),
   // and NO inference:r (we never point a RAG capability at a PHI corpus here).
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"]
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach, unchanged from this demo's original intent — a real clinical
+    // deployment should scope this (e.g. `scope:org`) before handling real PHI.
+    dataScope: {}
   },
   servicePrincipal: {
     externalId: "clinical-intake",
@@ -13421,7 +13480,6 @@ var clinicalIntake = {
 var clinical_intake_default = clinicalIntake;
 var BUNDLED_BLUEPRINTS = [
   task_management_default,
-  coding_agent_memory_default,
   agentic_sdlc_default,
   second_brain_default,
   clinical_intake_default
@@ -13720,18 +13778,17 @@ async function mintBridgeToken(opts) {
     ttlSeconds = DEFAULT_BRIDGE_TTL_SECONDS,
     tenant = "live",
     useScopedToken = false,
+    contextId,
     fetchImpl = fetch
   } = opts;
   const base = apiBaseUrl.replace(/\/$/, "");
   const path4 = bridgeTokenPath(useScopedToken);
-  const url = `${base}${path4}?ttl=${encodeURIComponent(String(ttlSeconds))}&tenant=${encodeURIComponent(tenant)}`;
-  return fetchStToken(
-    url,
-    cognitoToken,
-    fetchImpl,
-    path4,
-    (status) => status === 404 && !useScopedToken ? ` (the dedicated ${CLI_BOOTSTRAP_TOKEN_PATH} endpoint may not be deployed yet \u2014 retry with --use-scoped-token for the fallback path)` : ""
-  );
+  let url = `${base}${path4}?ttl=${encodeURIComponent(String(ttlSeconds))}&tenant=${encodeURIComponent(tenant)}`;
+  if (contextId) url += `&context=${encodeURIComponent(contextId)}`;
+  return fetchStToken(url, cognitoToken, fetchImpl, path4, (status) => {
+    if (status !== 404 || useScopedToken || contextId) return "";
+    return ` (the dedicated ${CLI_BOOTSTRAP_TOKEN_PATH} endpoint may not be deployed yet \u2014 retry with --use-scoped-token for the fallback path)`;
+  });
 }
 async function mintContextToken(opts) {
   const {
@@ -14114,8 +14171,29 @@ var KNOWN_CONTROL_PLANE_RESOURCES = [
   // control-plane, unlike per-namespace entity CRUD. (Cosmetic: any
   // non-data-plane resource hard-rejects whether or not it is listed here;
   // this list only sharpens the error message.)
+  //
+  // ⚠️ This bars `namespaces` as a SCOPE — no partner-authored role can ever
+  // be granted it. It does NOT bar a blueprint's own top-level `namespaces[]`
+  // FORMAT field (@vectros-ai/blueprints), which deliberately DOES write this
+  // same registry — the same "DISCRETIONARY vs UNCONDITIONAL" distinction
+  // {@link PARTIALLY_ADMITTED_OPS} draws for `entities`, applied here: the
+  // write rides `provisioning:c` (non-grantable — no partner role can ever
+  // hold it, the same bearer `keys`/`app-contexts` writes already require)
+  // and the platform confines it to the blueprint's OWN context
+  // unconditionally, never tenant-wide, so the reach is bounded to what the
+  // blueprint already provisions, never the pack's say-so alone. See
+  // `@vectros-ai/blueprints`' `namespaces[]` doc for the full design.
   "namespaces"
 ];
+var PARTIALLY_ADMITTED_OPS = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["r", "u", "d"])]
+]);
+var SELF_QUALIFIED_OPS = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["c"])]
+]);
+var UNQUALIFIABLE_WITH_ANY_TAIL = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["r"])]
+]);
 var VALID_OPS = /* @__PURE__ */ new Set(["c", "r", "u", "d"]);
 var DATA_PLANE_SET = new Set(DATA_PLANE_ALLOWLIST);
 var CONTROL_PLANE_SET = new Set(KNOWN_CONTROL_PLANE_RESOURCES);
@@ -14131,7 +14209,60 @@ ${summary}`
     this.name = "ScopeGateError";
     this.rejected = rejected;
   }
-};
+};
+var GRANTED_CAPABILITIES_ALLOWLIST = ["member-lifecycle"];
+var GRANTED_CAPABILITIES_SET = new Set(GRANTED_CAPABILITIES_ALLOWLIST);
+var CAPABILITIES_HINT = GRANTED_CAPABILITIES_ALLOWLIST.join("/");
+var CapabilityGateError = class extends Error {
+  rejected;
+  constructor(rejected) {
+    const summary = rejected.map((r) => `  \u2022 ${r.action}: ${r.reason}`).join("\n");
+    super(
+      `Capability gate rejected ${rejected.length} requested capability(ies); the bootstrap loader grants (${CAPABILITIES_HINT}) only and mints nothing on reject:
+${summary}`
+    );
+    this.name = "CapabilityGateError";
+    this.rejected = rejected;
+  }
+};
+function evaluateCapabilityToken(name) {
+  const token = name.trim();
+  if (token.length === 0) {
+    return { action: name, reason: "empty capability name" };
+  }
+  if (!GRANTED_CAPABILITIES_SET.has(token)) {
+    return {
+      action: name,
+      reason: `requests capability '${token}', which the bootstrap loader does not grant (${CAPABILITIES_HINT} only). A capability outside this list must be requested deliberately in the developer portal, never via the bootstrap loader`
+    };
+  }
+  return null;
+}
+function evaluateCapabilityGate(capabilities) {
+  const accepted = [];
+  const rejected = [];
+  for (const name of capabilities ?? []) {
+    const rejection = evaluateCapabilityToken(name);
+    if (rejection) {
+      rejected.push(rejection);
+    } else {
+      accepted.push(name);
+    }
+  }
+  return { ok: rejected.length === 0, accepted, rejected };
+}
+function assertCapabilityGate(capabilities) {
+  const result = evaluateCapabilityGate(capabilities);
+  if (!result.ok) {
+    throw new CapabilityGateError(result.rejected);
+  }
+}
+function firstInvalidOp(ops) {
+  for (const ch of ops) {
+    if (!VALID_OPS.has(ch)) return ch;
+  }
+  return void 0;
+}
 function evaluateScopeToken(action) {
   const token = action.trim();
   if (token.length === 0) {
@@ -14153,6 +14284,48 @@ function evaluateScopeToken(action) {
     };
   }
   if (!DATA_PLANE_SET.has(resource)) {
+    const admittedOps = PARTIALLY_ADMITTED_OPS.get(resource);
+    const selfOnlyOps = SELF_QUALIFIED_OPS.get(resource);
+    if (admittedOps || selfOnlyOps) {
+      const admittedHint = [.../* @__PURE__ */ new Set([...admittedOps ?? [], ...selfOnlyOps ?? []])].sort().join("/");
+      if (ops === "*") {
+        return {
+          action,
+          reason: `requests '${resource}:*', which includes operation(s) outside the narrow allowlist (${admittedHint}) admitted for this control-plane resource. Request only the specific operations you need`
+        };
+      }
+      const invalidOp2 = firstInvalidOp(ops);
+      if (invalidOp2) {
+        return {
+          action,
+          reason: `invalid operation character '${invalidOp2}' (valid operations are c, r, u, d, or '*')`
+        };
+      }
+      const qualifier = parts.length > 2 ? parts.slice(2).join(":") : void 0;
+      const isSelfQualified = qualifier === "self";
+      const unqualifiableOps = UNQUALIFIABLE_WITH_ANY_TAIL.get(resource);
+      for (const ch of ops) {
+        if (qualifier !== void 0 && unqualifiableOps?.has(ch)) {
+          return {
+            action,
+            reason: `requests '${resource}:${ch}' alongside a qualifier ('${qualifier}'), but the platform does not resolve a qualifier for '${ch}' on '${resource}' at all \u2014 it will reject the WHOLE entry as malformed, not just ignore the qualifier. Split into separate entries (e.g. '${resource}:${ch}' + the other op(s) with their qualifier).`
+          };
+        }
+        if (admittedOps?.has(ch)) continue;
+        if (selfOnlyOps?.has(ch)) {
+          if (isSelfQualified) continue;
+          return {
+            action,
+            reason: `requests control-plane scope '${resource}:${ch}' without the required ':self' qualifier. A bare or arbitrarily-qualified '${resource}:${ch}' is outside the narrow allowlist (${admittedHint}) admitted for this resource \u2014 only '${resource}:${ch}:self' is. That operation must otherwise be done deliberately in the developer portal, never via the bootstrap loader`
+          };
+        }
+        return {
+          action,
+          reason: `requests control-plane scope '${resource}:${ch}', which is outside the narrow allowlist (${admittedHint}) admitted for this resource. That operation must be done deliberately in the developer portal, never via the bootstrap loader`
+        };
+      }
+      return null;
+    }
     if (CONTROL_PLANE_SET.has(resource)) {
       return {
         action,
@@ -14167,13 +14340,12 @@ function evaluateScopeToken(action) {
   if (ops === "*") {
     return null;
   }
-  for (const ch of ops) {
-    if (!VALID_OPS.has(ch)) {
-      return {
-        action,
-        reason: `invalid operation character '${ch}' (valid operations are c, r, u, d, or '*')`
-      };
-    }
+  const invalidOp = firstInvalidOp(ops);
+  if (invalidOp) {
+    return {
+      action,
+      reason: `invalid operation character '${invalidOp}' (valid operations are c, r, u, d, or '*')`
+    };
   }
   return null;
 }
@@ -14196,6 +14368,16 @@ function assertScopeGate(allowedActions) {
     throw new ScopeGateError(result.rejected);
   }
 }
+function assertBlueprintGates(blueprint) {
+  assertScopeGate(blueprint.accessProfile.allowedActions);
+  assertCapabilityGate(blueprint.accessProfile.capabilities);
+  for (const clauses of Object.values(blueprint.roles ?? {})) {
+    for (const clause of clauses) {
+      assertScopeGate(clause.allowedActions);
+      assertCapabilityGate(clause.capabilities);
+    }
+  }
+}
 
 // src/machine-id.ts
 var import_node_fs = require("fs");
@@ -14300,6 +14482,68 @@ async function resolveApplyTimeIdentities(blueprint, client, log) {
 function actionOf(created) {
   return created ? "created" : "reconciled";
 }
+async function registerNamespaceIdempotently(client, contextIdForRequest, decl) {
+  const body = {
+    namespace: decl.namespace,
+    entityBacked: decl.entityBacked,
+    specificityRank: decl.specificityRank,
+    membershipRecordType: decl.membershipRecordType,
+    membershipTargetField: decl.membershipTargetField,
+    membershipLevelField: decl.membershipLevelField,
+    membershipLevels: decl.membershipLevels
+  };
+  try {
+    await client.registerNamespace({ contextId: contextIdForRequest, body });
+    return "created";
+  } catch (err) {
+    const info = extractServerError(err);
+    if (info.statusCode !== 400) throw err;
+    let existing;
+    try {
+      existing = await client.getNamespace({ namespace: decl.namespace, contextId: contextIdForRequest });
+    } catch {
+      throw err;
+    }
+    if (existing.contextId !== contextIdForRequest) throw err;
+    const mismatch = describeNamespaceMismatch(decl, existing);
+    if (mismatch) {
+      throw new Error(
+        `namespace '${decl.namespace}' is already registered with different settings than this blueprint declares (${mismatch}) \u2014 this looks like a collision with another blueprint or a manual registration, not a benign re-apply. Resolve the disagreement (or rename this blueprint's namespace) before re-applying.`
+      );
+    }
+    return "reconciled";
+  }
+}
+function describeNamespaceMismatch(decl, existing) {
+  const mismatches = [];
+  const declaredEntityBacked = decl.entityBacked ?? false;
+  const existingEntityBacked = existing.entityBacked ?? false;
+  if (declaredEntityBacked !== existingEntityBacked) {
+    mismatches.push(
+      `entityBacked: declared ${JSON.stringify(declaredEntityBacked)}, registered ${JSON.stringify(existingEntityBacked)}`
+    );
+  }
+  const fields = [
+    "specificityRank",
+    "membershipRecordType",
+    "membershipTargetField",
+    "membershipLevelField"
+  ];
+  for (const field of fields) {
+    const declared = decl[field];
+    const existingValue = existing[field];
+    if (declared === void 0 && (existingValue === void 0 || existingValue === null)) continue;
+    if (declared === existingValue) continue;
+    mismatches.push(`${field}: declared ${JSON.stringify(declared)}, registered ${JSON.stringify(existingValue)}`);
+  }
+  const declaredLevels = decl.membershipLevels;
+  const existingLevels = existing.membershipLevels;
+  const levelsDiffer = declaredLevels === void 0 ? existingLevels != null && existingLevels.length > 0 : JSON.stringify([...declaredLevels].sort()) !== JSON.stringify([...existingLevels ?? []].sort());
+  if (levelsDiffer) {
+    mismatches.push(`membershipLevels: declared ${JSON.stringify(declaredLevels)}, registered ${JSON.stringify(existingLevels)}`);
+  }
+  return mismatches.length > 0 ? mismatches.join("; ") : null;
+}
 var LostKeyError = class extends Error {
   constructor(keyName) {
     super(
@@ -14310,6 +14554,20 @@ var LostKeyError = class extends Error {
   }
   keyName;
 };
+var ExistingPrincipalNotConfirmedError = class extends Error {
+  constructor(contextId, userId, externalId) {
+    super(
+      `About to bind a NEW scoped key to a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either an intentional multi-machine setup for an integration you already own, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before a new credential is minted bound to it.`
+    );
+    this.contextId = contextId;
+    this.userId = userId;
+    this.externalId = externalId;
+    this.name = "ExistingPrincipalNotConfirmedError";
+  }
+  contextId;
+  userId;
+  externalId;
+};
 function mapEnumValues(enumValues) {
   if (!enumValues) return void 0;
   return enumValues.map((value) => ({ value }));
@@ -14384,7 +14642,8 @@ function toCapabilities(capabilities) {
 function toRoleScopeClauses(clauses) {
   return clauses.map((c) => ({
     allowed_actions: c.allowedActions,
-    data_scope: c.dataScope
+    data_scope: c.dataScope,
+    granted_capabilities: c.capabilities
   }));
 }
 var UnresolvedIdentitiesError = class extends Error {
@@ -14404,11 +14663,18 @@ function assertNoUnresolvedIdentities(blueprint) {
   }
 }
 async function runLoader(client, input) {
-  const { blueprint, tenantId, machineId, rotate = false, skipSeed = false, readExistingKey, persistMintedKey, log } = input;
-  assertScopeGate(blueprint.accessProfile.allowedActions);
-  for (const clauses of Object.values(blueprint.roles ?? {})) {
-    for (const clause of clauses) assertScopeGate(clause.allowedActions);
-  }
+  const {
+    blueprint,
+    tenantId,
+    machineId,
+    rotate = false,
+    skipSeed = false,
+    readExistingKey,
+    persistMintedKey,
+    confirmExistingPrincipal,
+    log
+  } = input;
+  assertBlueprintGates(blueprint);
   assertNoUnresolvedIdentities(blueprint);
   const ctxResp = await client.auth.createAppContext({ body: { contextId: blueprint.contextId, name: contextNameOf(blueprint) } });
   const contextAction = actionOf(ctxResp.created);
@@ -14426,10 +14692,42 @@ async function runLoader(client, input) {
   if (!userId) {
     throw new Error("Service-principal create returned no user id; cannot bind AccessProfile/key.");
   }
-  log.debug({ component: "loader", externalId: blueprint.servicePrincipal.externalId, userId }, "service principal ensured");
+  const userAction = actionOf(user.created);
+  log.debug(
+    { component: "loader", externalId: blueprint.servicePrincipal.externalId, userId, userAction },
+    "service principal ensured"
+  );
+  const localKeyForContext = await readExistingKey(blueprint.contextId);
+  const storedPrincipalId = localKeyForContext?.principalId;
+  const localKeyNamesThisPrincipal = storedPrincipalId === `usr_${userId}` || storedPrincipalId === userId;
+  if (userAction === "reconciled" && !localKeyNamesThisPrincipal) {
+    const proceed = confirmExistingPrincipal ? await confirmExistingPrincipal({
+      contextId: blueprint.contextId,
+      userId,
+      externalId: blueprint.servicePrincipal.externalId
+    }) : true;
+    if (!proceed) {
+      throw new ExistingPrincipalNotConfirmedError(blueprint.contextId, userId, blueprint.servicePrincipal.externalId);
+    }
+    log.debug(
+      { component: "loader", contextId: blueprint.contextId, userId },
+      "existing-principal collision confirmed (or unwired) \u2014 proceeding with any further write to this principal"
+    );
+  }
+  const needsContextPinnedBootstrap = (blueprint.issuers ?? []).length > 0 || (blueprint.namespaces ?? []).length > 0;
+  const ctxBootstrapClient = needsContextPinnedBootstrap ? input.remintBootstrapForContext ? await input.remintBootstrapForContext(blueprint.contextId) : client : void 0;
+  if (ctxBootstrapClient && input.remintBootstrapForContext) {
+    log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted context-pinned bootstrap client");
+  }
+  const namespaceActions = [];
+  for (const ns of blueprint.namespaces ?? []) {
+    const action = await registerNamespaceIdempotently(ctxBootstrapClient.identity, blueprint.contextId, ns);
+    namespaceActions.push({ namespace: ns.namespace, action });
+    log.debug({ component: "loader", namespace: ns.namespace, contextId: blueprint.contextId, action }, "namespace ensured");
+  }
   const issuerActions = [];
   for (const issuer of blueprint.issuers ?? []) {
-    const issuerResp = await client.auth.registerIssuer({
+    const issuerResp = await ctxBootstrapClient.auth.registerIssuer({
       issuerId: issuer.issuerId,
       issuer: issuer.issuer,
       jwksUri: issuer.jwksUri,
@@ -14499,7 +14797,10 @@ async function runLoader(client, input) {
         // literal JSON null, which is exactly what the platform's scope
         // matcher tests via `allowedValues.contains(null)`. The cast bridges
         // to the SDK's loosely-typed Record<string, Record<string,unknown>>.
-        data_scope: blueprint.accessProfile.dataScope
+        data_scope: blueprint.accessProfile.dataScope,
+        // Already gate-validated (assertBlueprintGates, above this function's
+        // call site) before this body is ever built.
+        granted_capabilities: blueprint.accessProfile.capabilities
       }
     ],
     // Optional identity overrides — scope values the service key STAMPS onto
@@ -14557,7 +14858,7 @@ async function runLoader(client, input) {
     keyId = keyResp.keyId ?? "";
     rawKey = keyResp.rawKey;
     if (keyId) {
-      await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: userId, revokedKeyId });
+      await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: `usr_${userId}`, revokedKeyId });
     }
     if (keyAction !== "rotated") keyAction = "created";
   } else {
@@ -14631,10 +14932,12 @@ async function runLoader(client, input) {
     keyName,
     keyAction,
     contextAction,
+    userAction,
     profileAction,
     schemaActions,
     roleActions,
     issuerActions,
+    namespaceActions,
     rawKey,
     keyId,
     revokedKeyId,
@@ -14653,6 +14956,15 @@ function buildPlan(blueprint, opts = {}) {
     kind: "principal",
     summary: `principal '${blueprint.servicePrincipal.externalId}' (SERVICE)`
   });
+  for (const ns of blueprint.namespaces ?? []) {
+    const ownerNote = `owned by '${blueprint.contextId}'`;
+    const entityNote = ns.entityBacked ? ", entity-backed" : "";
+    const membershipNote = ns.membershipRecordType ? `, membership: ${ns.membershipRecordType}.${ns.membershipTargetField}` + (ns.membershipLevelField ? ` (levels: ${ns.membershipLevels?.join("/")})` : "") : "";
+    steps.push({
+      kind: "namespace",
+      summary: `namespace '${ns.namespace}' (${ownerNote}${entityNote}${membershipNote}) [${BLUEPRINT_FIELD_PHASES.namespaces}-token phase]`
+    });
+  }
   for (const iss of blueprint.issuers ?? []) {
     const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: ${iss.selfSignupPolicies.length} polic${iss.selfSignupPolicies.length === 1 ? "y" : "ies"}` : "";
     steps.push({
@@ -14675,15 +14987,18 @@ function buildPlan(blueprint, opts = {}) {
   }
   const actions = blueprint.accessProfile.allowedActions;
   const scopeNote = blueprint.accessProfile.dataScope && Object.keys(blueprint.accessProfile.dataScope).length ? ` dataScope: ${Object.keys(blueprint.accessProfile.dataScope).join(", ")}` : "";
+  const capabilityNote = blueprint.accessProfile.capabilities?.length ? ` capabilities: [${blueprint.accessProfile.capabilities.join(", ")}]` : "";
   steps.push({
     kind: "profile",
-    summary: `profile scopes [${actions.join(", ")}] (data-plane \u2713)${scopeNote}`
+    summary: `profile scopes [${actions.join(", ")}] (data-plane \u2713)${scopeNote}${capabilityNote}`
   });
   for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
     const actionSet = [...new Set(clauses.flatMap((c) => c.allowedActions))];
+    const capSet = [...new Set(clauses.flatMap((c) => c.capabilities ?? []))];
+    const roleCapabilityNote = capSet.length ? `, capabilities [${capSet.join(", ")}]` : "";
     steps.push({
       kind: "role",
-      summary: `role '${roleId}' (${clauses.length} clause${clauses.length === 1 ? "" : "s"}, actions [${actionSet.join(", ")}])`
+      summary: `role '${roleId}' (${clauses.length} clause${clauses.length === 1 ? "" : "s"}, actions [${actionSet.join(", ")}]${roleCapabilityNote})`
     });
   }
   steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
@@ -14710,6 +15025,13 @@ function renderPlan(blueprint, steps) {
       `  issuer is left unchanged, not reconciled to match.`
     );
   }
+  if (steps.some((s) => s.kind === "namespace")) {
+    legendLines.push(
+      `  Exception: namespace registration is not idempotent \u2014 a re-apply matching`,
+      `  an existing registration converges silently, but one that disagrees FAILS`,
+      `  the apply rather than reconciling it.`
+    );
+  }
   const legend = legendLines.join("\n");
   const lines = steps.map((s) => `    + ${s.summary}`);
   return [header, legend, "", ...lines].join("\n");
@@ -14958,6 +15280,15 @@ var OsKeychainSecretStore = class {
    * against the real Windows store on every MR — the dev-machine probe is a point
    * measurement, not a regression gate. (Tracked internally; this file ships to
    * public npm, so no tracker number here.)
+   *
+   * ⚠️ THIS METHOD'S FAIL-CLOSED GUARANTEE IS AN UPSTREAM BEHAVIOURAL CONTRACT, NOT
+   * SOMETHING THIS CODE ENFORCES. `@napi-rs/keyring` is pinned to an EXACT version
+   * in `package.json` for exactly this reason: if a future release returned `[]`
+   * from `findCredentials()` on a locked store instead of throwing, the `catch`
+   * block above would never run — `!.some(...)` on an empty array reads as "gone",
+   * `deleteSecret` returns `true`, and `remove`/`prune` drop the index row of a
+   * still-live credential. A version bump of this dependency is a security review
+   * of the paragraph above against the new release, not a routine dependency bump.
    */
   async deleteSecret(ref) {
     try {
@@ -15891,6 +16222,26 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
     const entry = await this.getActive();
     return entry ? this.readSecret(entry) : void 0;
   }
+  /**
+   * The ACTIVE entry's tenant (test/live), or undefined if there is no active
+   * entry or its tenant cannot be determined — WITHOUT migrating its secret.
+   *
+   * Deliberately NOT built on {@link resolveActiveSecret}/{@link readSecret}:
+   * both migrate the secret to this machine's preferred store as a side effect
+   * of reading it, and a caller that only wants to CLASSIFY the active identity
+   * (e.g. "is it safe to activate a different one over it?") must not silently
+   * relocate — and take the cross-process index lock for — a credential it has
+   * no other reason to touch. Same non-migrating shape {@link assess} already
+   * uses per entry (`store.getSecret` directly, never `readSecret`).
+   */
+  async activeTenant() {
+    const entry = await this.getActive();
+    if (!entry) return void 0;
+    const store = this.storeFor(entry);
+    if (!store) return void 0;
+    const secret = await store.getSecret(entry.secretRef);
+    return secret !== void 0 ? keyTenant(secret) : void 0;
+  }
   /**
    * Read one entry's secret, moving it to this machine's preferred store if it is
    * somewhere else.
@@ -16017,26 +16368,31 @@ var readline = __toESM(require("readline/promises"));
 async function runKeyringList(opts, deps = {}) {
   try {
     const keyring = deps.keyring ?? await Keyring.open();
-    const entries = await keyring.list();
-    const active = await keyring.activeAlias();
     if (opts.json) {
+      const entries = await keyring.list();
+      const active = await keyring.activeAlias();
       process.stdout.write(`${formatJson({ active, entries })}
 `);
       return 0;
     }
-    if (entries.length === 0) {
+    const { health } = await assessEntries(keyring);
+    if (health.length === 0) {
       process.stdout.write("\n  (no keyring entries yet \u2014 run `vectros join <context>` to add one)\n");
       return 0;
     }
     process.stdout.write(
-      "\n" + formatTable(entries, [
-        { header: "", get: (e) => e.alias === active ? "*" : "" },
-        { header: "alias", get: (e) => e.alias },
-        { header: "context", get: (e) => e.context },
-        { header: "principal", get: (e) => e.principalId },
-        { header: "role", get: (e) => e.role },
-        { header: "env", get: (e) => e.env },
-        { header: "key id", get: (e) => e.keyId }
+      "\n" + formatTable(health, [
+        { header: "", get: (h) => h.active ? "*" : "" },
+        { header: "alias", get: (h) => h.entry.alias },
+        { header: "context", get: (h) => h.entry.context },
+        { header: "principal", get: (h) => h.entry.principalId },
+        { header: "role", get: (h) => h.entry.role },
+        // `tenant` (test/live) replaces the old `env` (staging/production) column
+        // here: env is an internal-team concern an external developer's CLI never
+        // sees, while tenant is the distinction every user routinely holds two
+        // credentials side by side over.
+        { header: "tenant", get: (h) => tenantCell(h, { upper: true }) },
+        { header: "key id", get: (h) => h.entry.keyId }
       ]) + "\n"
     );
     return 0;
@@ -16218,6 +16574,10 @@ async function assessEntries(keyring) {
     }))
   };
 }
+function tenantCell(h, opts) {
+  if (h.status !== "ok") return void 0;
+  return h.tenant ?? (opts.upper ? "UNKNOWN" : "unknown");
+}
 function describeEntry(h) {
   return `${h.entry.alias} (${h.entry.context}, ${h.entry.keyId})`;
 }
@@ -16362,9 +16722,7 @@ async function runKeyringDoctor(opts, deps = {}) {
           // `unknown` can escalate; one that sees a confident wrong answer cannot.
           store: storeKindOf(h.entry) ?? "unknown",
           secret: h.status,
-          // `unknown` rather than absent: a consumer must be able to tell "not a
-          // live key" from "we could not read the shape of this one".
-          tenant: h.status === "ok" ? h.tenant ?? "unknown" : void 0
+          tenant: tenantCell(h, { upper: false })
         })),
         liveKeys: liveKeys.map((h) => h.entry.alias),
         findings
@@ -16379,7 +16737,7 @@ async function runKeyringDoctor(opts, deps = {}) {
         { header: "", get: (h) => h.active ? "*" : "" },
         { header: "alias", get: (h) => h.entry.alias },
         { header: "context", get: (h) => h.entry.context },
-        { header: "tenant", get: (h) => h.status === "ok" ? h.tenant ?? "UNKNOWN" : void 0 },
+        { header: "tenant", get: (h) => tenantCell(h, { upper: true }) },
         { header: "key id", get: (h) => h.entry.keyId },
         { header: "secret", get: (h) => h.status === "ok" ? "ok" : h.status.toUpperCase() }
       ]) + "\n"
@@ -16573,6 +16931,47 @@ function keyringAliasFor(alias, tenant) {
   }
   return tenant === "test" ? `${alias}.test` : alias;
 }
+function resolveActivateDecision(opts) {
+  if (opts.explicitActivate !== void 0) return opts.explicitActivate;
+  if (opts.tenant === "live") return true;
+  return opts.currentActiveTenant !== "live";
+}
+async function determineActivateDecision(keyring, opts) {
+  if (opts.explicitActivate !== void 0 || opts.tenant === "live") {
+    return resolveActivateDecision(opts);
+  }
+  let currentActiveTenant;
+  try {
+    if (opts.hint && opts.hint.alias === await keyring.activeAlias()) {
+      currentActiveTenant = keyTenant(opts.hint.secret);
+    } else {
+      currentActiveTenant = await keyring.activeTenant();
+    }
+  } catch {
+  }
+  return resolveActivateDecision({ ...opts, currentActiveTenant });
+}
+function tenantActivateMessage(opts) {
+  if (opts.willActivate) {
+    if (opts.tenant !== "test") return "";
+    return `
+  \u26A0 '${opts.alias}' is now your ACTIVE identity \u2014 a TEST tenant credential. Anything
+    resolving a key with no explicit --alias (including the MCP server) follows it.
+`;
+  }
+  if (opts.explicitlyDeclined) {
+    return `
+  \u26A0 Stored '${opts.alias}' (${opts.tenant} tenant) without activating it \u2014 you passed --no-activate.
+    Run \`vectros switch ${opts.alias}\` when you're ready to use it.
+`;
+  }
+  return `
+  \u26A0 Stored '${opts.alias}' (test tenant) WITHOUT activating it \u2014 your currently-active
+    identity is a LIVE credential, and switching it out from under you silently is
+    exactly the mistake this check exists to prevent. Run \`vectros switch ${opts.alias}\`
+    to use the test key, or re-run with --activate to do so automatically.
+`;
+}
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -16669,10 +17068,7 @@ async function storeMintedKey(keyring, binding, secret, opts = {}) {
 // src/cli-bootstrap.ts
 function validateBlueprint(input) {
   const blueprint = parseBlueprint(input);
-  assertScopeGate(blueprint.accessProfile.allowedActions);
-  for (const clauses of Object.values(blueprint.roles ?? {})) {
-    for (const clause of clauses) assertScopeGate(clause.allowedActions);
-  }
+  assertBlueprintGates(blueprint);
   return blueprint;
 }
 var BLANK_SLATE = {
@@ -16694,6 +17090,7 @@ function parseBootstrapArgs(argv) {
     yes: false,
     noMerge: false,
     rotate: false,
+    confirmExistingPrincipal: false,
     useScopedToken: false,
     blankSlate: false,
     noSeed: false,
@@ -16745,6 +17142,9 @@ function parseBootstrapArgs(argv) {
       case "--rotate":
         args.rotate = true;
         break;
+      case "--confirm-existing-principal":
+        args.confirmExistingPrincipal = true;
+        break;
       case "--use-scoped-token":
         args.useScopedToken = true;
         break;
@@ -16766,6 +17166,12 @@ function parseBootstrapArgs(argv) {
       case "--test":
         args.tenant = "test";
         break;
+      case "--activate":
+        args.activate = true;
+        break;
+      case "--no-activate":
+        args.activate = false;
+        break;
       case "--help":
       case "-h":
         args.help = true;
@@ -16783,6 +17189,26 @@ function seedDeclined(answer) {
   const a = answer.trim().toLowerCase();
   return a === "n" || a === "no";
 }
+function existingPrincipalConfirmed(answer) {
+  const a = answer.trim().toLowerCase();
+  return a === "y" || a === "yes";
+}
+function buildConfirmExistingPrincipal(args, prompt, isTty) {
+  return async (details) => {
+    if (!args.yes && isTty) {
+      const ans = await prompt(
+        `
+  \u26A0 '${details.externalId}' already exists in your tenant (context '${details.contextId}') \u2014 this key will bind to that EXISTING identity, not a new one.
+  Expected if you're re-applying a blueprint from a new machine, or setting up a second
+  credential for an integration you already own. If you don't recognize this identity,
+  do NOT proceed \u2014 this may be a name collision with something you don't control.
+  Proceed and bind to the existing identity? [y/N]: `
+      );
+      return existingPrincipalConfirmed(ans);
+    }
+    return args.confirmExistingPrincipal;
+  };
+}
 function seedSummaryLine(opts) {
   if (opts.noSeed) {
     return opts.declinedInteractively ? "  \u2714 Seeded 0 record(s) \u2014 skipped (you declined sample data)\n" : "  \u2714 Seeded 0 record(s) \u2014 skipped (--no-seed)\n";
@@ -16819,16 +17245,28 @@ function issuerTally(items) {
   if (unchanged) seg.push(`${unchanged} already registered \u2014 unchanged (issuers cannot be updated once registered)`);
   return `${items.length} issuer${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
 }
+function namespaceTally(items) {
+  if (items.length === 0) return null;
+  const created = items.filter((i) => i.action === "created").length;
+  const matched = items.length - created;
+  const seg = [];
+  if (created) seg.push(`${created} created`);
+  if (matched) seg.push(`${matched} already registered \u2014 confirmed matching`);
+  return `${items.length} namespace${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
+}
 function applyOutcomeSummary(result) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
     reconcileTally(result.roleActions, "role"),
     issuerTally(result.issuerActions),
+    namespaceTally(result.namespaceActions),
     `profile ${result.profileAction}`
   ].filter((p) => p !== null);
   const detail = parts.length ? ` \u2014 ${parts.join("; ")}` : "";
+  const principalNote = result.userAction === "reconciled" ? `  \u26A0 service principal already existed in this tenant before this run (not newly created)
+` : "";
   return `  \u2714 context '${result.contextId}' ${result.contextAction}${detail}
-`;
+${principalNote}`;
 }
 var BOOTSTRAP_HELP = `vectros bootstrap \u2014 provision a least-privilege MCP credential.
 
@@ -16836,7 +17274,7 @@ Usage:
   vectros bootstrap [--blueprint <name> | --blank] [--no-seed]
                     [--set name=value ...] [--values <file>]
                     [--tenant test|live | --test] [--client desktop|code]
-                    [--yes] [--no-merge] [--rotate]
+                    [--yes] [--no-merge] [--rotate] [--confirm-existing-principal]
                     [--token <t> | env VECTROS_BOOTSTRAP_TOKEN]
                     [--base-url <url>] [--use-scoped-token]
 
@@ -16859,6 +17297,10 @@ Options:
                            The tenant rides the key (ssk_test_* vs ssk_live_*), so
                            the MCP/client config is otherwise identical.
   --test                   Shorthand for --tenant test.
+  --activate               Force the freshly-stored key to become your active identity, even
+                           if that would switch away from a currently-active LIVE credential
+                           (the one case --tenant test does NOT do this automatically).
+  --no-activate            Store the key without activating it, regardless of tenant.
   --base-url <url>         Override the API base URL (beats VECTROS_API_BASE_URL).
   --client <desktop|code>  MCP host to configure (default: desktop). 'desktop' merges
                            claude_desktop_config.json (also works for Cursor/Cline);
@@ -16873,6 +17315,13 @@ Options:
                            print the config snippet instead of merging it into your client's
                            config file. Not a dry run; see 'blueprint plan' for that.
   --rotate                 Revoke + re-mint THIS machine's key.
+  --confirm-existing-principal
+                           Required (with --yes, or with no TTY) to mint a NEW key bound to a
+                           service principal that already existed in your tenant before this run
+                           \u2014 e.g. a deliberate second machine for an integration you already own.
+                           Refused by default so an unexpected collision halts a CI run loudly
+                           instead of silently minting a credential bound to the wrong identity.
+                           Never needed for --rotate or an ordinary same-machine re-apply.
   --use-scoped-token       Legacy fallback.
                            NOTE: it mints a token WITHOUT the provisioning
                            capability, so it cannot create a blueprint's
@@ -16960,6 +17409,22 @@ function buildRemintForContext(opts) {
     });
   };
 }
+function buildRemintBootstrapForContext(opts) {
+  const mintBridge = opts.mintBridge ?? mintBridgeToken;
+  return async (contextId) => {
+    const ctxToken = await mintBridge({
+      cognitoToken: opts.cognitoToken,
+      apiBaseUrl: opts.apiBaseUrl,
+      contextId,
+      tenant: opts.tenant,
+      useScopedToken: opts.useScopedToken
+    });
+    return new VectrosClient({
+      token: ctxToken.token,
+      environment: opts.apiBaseUrl
+    });
+  };
+}
 async function runBootstrapCli(argv, deps = {}) {
   const log = deps.log ?? createLogger2();
   let args;
@@ -16993,6 +17458,15 @@ ${BOOTSTRAP_HELP}
   \u2716 Scope gate refused blueprint '${blueprint.name}':
 `);
         for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+        process.stderr.write("  Minting nothing.\n");
+        return 2;
+      }
+      if (err instanceof CapabilityGateError) {
+        process.stderr.write(`
+  \u2716 Capability gate refused blueprint '${blueprint.name}':
+`);
+        for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
         process.stderr.write("  Minting nothing.\n");
         return 2;
@@ -17004,6 +17478,11 @@ ${BOOTSTRAP_HELP}
   Blueprint: ${blueprint.name}
   \u2714 Scope gate: [${gate.accepted.join(", ")}] \u2014 all data-plane \u2713
 `);
+    if (blueprint.accessProfile.capabilities?.length) {
+      const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
+      process.stdout.write(`  \u2714 Capability gate: [${capGate.accepted.join(", ")}] \u2014 granted \u2713
+`);
+    }
     let noSeed = args.noSeed;
     let seedDeclinedInteractively = false;
     if (shouldOfferSeedOptOut(args, blueprint, isTty)) {
@@ -17077,6 +17556,7 @@ ${renderPlan(blueprint, planSteps)}
       keyringOpenError = err;
     }
     let storedFreshInKeyring = false;
+    const lastResolvedSecret = /* @__PURE__ */ new Map();
     const readExistingKey = async (contextId) => {
       if (!keyring) return void 0;
       const alias = keyringAliasFor(contextId, args.tenant);
@@ -17084,7 +17564,8 @@ ${renderPlan(blueprint, planSteps)}
         const existing = await keyring.get(alias);
         if (!existing?.keyId) return void 0;
         const rawKey = await keyring.resolveSecret(alias);
-        return rawKey ? { keyId: existing.keyId, rawKey } : void 0;
+        lastResolvedSecret.set(alias, rawKey);
+        return rawKey ? { keyId: existing.keyId, rawKey, principalId: existing.principalId } : void 0;
       } catch {
         return void 0;
       }
@@ -17103,6 +17584,11 @@ ${renderPlan(blueprint, planSteps)}
       const alias = keyringAliasFor(contextId, args.tenant);
       try {
         warnReplacingAlias(await keyring.get(alias), alias, record.revokedKeyId);
+        const willActivate = await determineActivateDecision(keyring, {
+          tenant: args.tenant,
+          explicitActivate: args.activate,
+          hint: lastResolvedSecret.has(alias) ? { alias, secret: lastResolvedSecret.get(alias) } : void 0
+        });
         await storeMintedKey(
           keyring,
           {
@@ -17117,11 +17603,14 @@ ${renderPlan(blueprint, planSteps)}
             env: deriveEnvironment(baseUrl) ?? args.env
           },
           record.rawKey,
-          { activate: true, revokedKeyId: record.revokedKeyId }
+          { activate: willActivate, revokedKeyId: record.revokedKeyId }
         );
         if (record.revokedKeyId) {
           await warnOtherAliasesNaming(keyring, record.revokedKeyId, alias);
         }
+        process.stdout.write(
+          tenantActivateMessage({ alias, tenant: args.tenant, willActivate, explicitlyDeclined: args.activate === false })
+        );
         storedFreshInKeyring = true;
       } catch (err) {
         process.stderr.write(
@@ -17142,12 +17631,20 @@ ${renderPlan(blueprint, planSteps)}
       skipSeed: noSeed,
       readExistingKey,
       persistMintedKey,
+      remintBootstrapForContext: buildRemintBootstrapForContext({
+        cognitoToken,
+        apiBaseUrl: baseUrl,
+        tenant: args.tenant,
+        useScopedToken: args.useScopedToken,
+        mintBridge
+      }),
       remintForContext: buildRemintForContext({
         cognitoToken,
         apiBaseUrl: baseUrl,
         tenant: args.tenant,
         mintContext
       }),
+      confirmExistingPrincipal: buildConfirmExistingPrincipal(args, promptCtx.prompt, isTty),
       log
     });
     process.stdout.write(
@@ -17225,6 +17722,18 @@ ${codeAddHint}`);
 `);
       return 3;
     }
+    if (err instanceof ExistingPrincipalNotConfirmedError) {
+      process.stderr.write(
+        `
+  \u2716 ${err.message}
+
+  If this is expected (a re-apply, or a deliberate second machine for an integration you already own),
+  re-run with --confirm-existing-principal, or confirm interactively.
+  If you don't recognize this identity, investigate the blueprint's servicePrincipal.externalId before re-running.
+`
+      );
+      return 3;
+    }
     if (err instanceof BlueprintIdentityError || err instanceof UnresolvedIdentitiesError) {
       process.stderr.write(`
   \u2716 ${err.message}
@@ -17445,6 +17954,10 @@ function lintBlueprint(bp) {
       }
     }
   }
+  {
+    const reached = ownerScopedReachWithoutDataScope(bp.accessProfile.allowedActions, ds);
+    if (reached.length > 0) findings.push(unconstrainedReachFinding("accessProfile", reached));
+  }
   for (const roleId of Object.keys(bp.roles ?? {})) {
     if (!ROLE_ID_RE.test(roleId)) {
       findings.push({
@@ -17457,6 +17970,10 @@ function lintBlueprint(bp) {
   for (const [roleId, clauses] of Object.entries(bp.roles ?? {})) {
     clauses.forEach((clause, i) => {
       const cds = clause.dataScope;
+      const reached = ownerScopedReachWithoutDataScope(clause.allowedActions, cds);
+      if (reached.length > 0) {
+        findings.push(unconstrainedReachFinding(`role '${roleId}' clause ${i}`, reached));
+      }
       if (!cds) return;
       for (const [key, values] of Object.entries(cds)) {
         for (const value of values) {
@@ -17509,6 +18026,25 @@ function placeholderFinding(where, key, value) {
     message: `${where}: dataScope.${key} value '${value}' is not a placeholder the platform recognizes \u2014 it will be rejected at apply. Valid: \${{ any }}, \${{ self.userId }}, \${{ self.scope.<namespace> }}, \${{ under.self.userId }}, \${{ under.self.scope.<namespace> }}. Spelling is exact and lowercase; use a plain value for a literal owner id.`
   };
 }
+var OWNER_SCOPED_RESOURCES = /* @__PURE__ */ new Set(["records", "documents", "entities"]);
+var UNCONSTRAINED_REACH_OPS = /* @__PURE__ */ new Set(["r", "u", "d"]);
+function ownerScopedReachWithoutDataScope(allowedActions, dataScope) {
+  const reached = /* @__PURE__ */ new Set();
+  for (const action of allowedActions) {
+    const [resource, ops] = action.split(":", 2);
+    if (!resource || !ops || !OWNER_SCOPED_RESOURCES.has(resource)) continue;
+    if (ops === "*" || [...ops].some((op) => UNCONSTRAINED_REACH_OPS.has(op))) reached.add(resource);
+  }
+  if (dataScope !== void 0) return [];
+  return [...reached].sort();
+}
+function unconstrainedReachFinding(where, resources) {
+  return {
+    severity: "warning",
+    rule: "datascope-absent-unconstrained-reach",
+    message: `${where}: no dataScope at all, but allowedActions grants r/u/d on ${resources.join("/")} \u2014 this reaches EVERY row of EVERY owner on ${resources.length > 1 ? "those resources" : "that resource"}, not just "your own org" or any other value you may have intended. If that's deliberate (a genuinely shared/tenant-wide resource), you can ignore this; otherwise add a dataScope entry.`
+  };
+}
 function lintPasses(findings) {
   return !findings.some((f) => f.severity === "error");
 }
@@ -17547,8 +18083,12 @@ schemas:
     lookupFields: [title]      # extra O(1) exact-match lookup indexes (max 10)
 
 accessProfile:
-  # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference/entities).
-  # Anything else (keys/profiles/users/admin/namespaces/*) is HARD-REJECTED \u2014 by design, no override.
+  # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference/entities),
+  # PLUS profiles:r/u/d (bounded by the platform to redistributing access you already have,
+  # never granting more) and profiles:c:self (create a profile for yourself only \u2014 the
+  # platform resolves "self" from the caller, not from anything you declare here). A bare
+  # profiles:c, or profiles:c:usr_<id> naming another principal, is HARD-REJECTED \u2014 by
+  # design, no override. Same for keys/users/admin/namespaces/*.
   # Ops: c|r|u|d, combinable (records:cru). Prefer the narrowest set (least privilege).
   allowedActions: [records:r, records:c, records:u, search:r, schemas:r]
   # dataScope binds the key to specific owners. Include null to ALSO see
@@ -17556,6 +18096,17 @@ accessProfile:
   # owners' records, not shared/seed data. Keys are userId (the principal) and
   # namespaced scopes (scope:org, scope:client, ...):
   # dataScope: { "scope:org": [<org-uuid>, null] }
+  # Left empty ({}) below \u2014 the explicit marker for "deliberately tenant-wide,
+  # every record visible" ('blueprint validate' warns on a MISSING dataScope
+  # key, but not on this one). This is a SCAFFOLD PLACEHOLDER, not a
+  # recommendation: it also grants records:c/u tenant-wide, so before this
+  # profile touches real data, replace it with a real scope (the example
+  # above) unless every owner genuinely sharing every record is what you want.
+  dataScope: {}
+  # capabilities is a SEPARATE gated dimension from allowedActions \u2014 named platform
+  # effects a resource:ops verb can't express. Only 'member-lifecycle' is admitted
+  # today; every other name is HARD-REJECTED, same posture as the scope gate above.
+  # capabilities: [member-lifecycle]
 
 servicePrincipal:
   externalId: ${name}-sp       # stable; the principal the profile + key bind to
@@ -17675,15 +18226,19 @@ async function resolveAndValidate(arg, verb, supplied) {
     return null;
   }
   try {
-    assertScopeGate(blueprint.accessProfile.allowedActions);
-    for (const clauses of Object.values(blueprint.roles ?? {})) {
-      for (const clause of clauses) assertScopeGate(clause.allowedActions);
-    }
+    assertBlueprintGates(blueprint);
   } catch (err) {
     if (err instanceof ScopeGateError) {
       process.stderr.write(`  \u2716 Scope gate rejected '${blueprint.name}':
 `);
       for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+      return null;
+    }
+    if (err instanceof CapabilityGateError) {
+      process.stderr.write(`  \u2716 Capability gate rejected '${blueprint.name}':
+`);
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
       return null;
     }
@@ -17715,9 +18270,10 @@ async function runValidate(args) {
   const blueprint = await resolveAndValidate(args.file, "validate", supplied);
   if (!blueprint) return 2;
   const gate = evaluateScopeGate(blueprint.accessProfile.allowedActions);
+  const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
   const warnCount = lintBlueprint(blueprint).length;
   process.stdout.write(
-    `  \u2714 '${blueprint.name}' is valid \u2014 structural \u2713, scope gate \u2713 [${gate.accepted.join(", ")}], lint \u2713` + (warnCount ? ` (${warnCount} warning${warnCount === 1 ? "" : "s"})` : "") + "\n"
+    `  \u2714 '${blueprint.name}' is valid \u2014 structural \u2713, scope gate \u2713 [${gate.accepted.join(", ")}]` + (capGate.accepted.length ? `, capability gate \u2713 [${capGate.accepted.join(", ")}]` : "") + `, lint \u2713` + (warnCount ? ` (${warnCount} warning${warnCount === 1 ? "" : "s"})` : "") + "\n"
   );
   return 0;
 }
@@ -18048,7 +18604,14 @@ async function resolveKeyDestination(opts, deps) {
 `);
     return 2;
   }
-  const alias = opts.alias ?? opts.context;
+  let alias;
+  try {
+    alias = keyringAliasFor(opts.alias ?? opts.context, opts.tenant ?? "live");
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
   if (opts.activate === false && await keyring.activeAlias() === alias) {
     process.stderr.write(
       `  \u2716 --no-activate cannot be used on '${alias}': it is your ACTIVE identity, and storing
@@ -18069,6 +18632,8 @@ async function storeAndReport(dest, key, auth, opts) {
     return 1;
   }
   const principalId = opts.principalId;
+  const tenant = keyTenant(key.rawKey) ?? "test";
+  const willActivate = await determineActivateDecision(dest.keyring, { tenant, explicitActivate: opts.activate });
   let entry;
   try {
     warnReplacingAlias(await dest.keyring.get(dest.alias), dest.alias, opts.revokedKeyId);
@@ -18083,7 +18648,7 @@ async function storeAndReport(dest, key, auth, opts) {
         env: auth.env
       },
       key.rawKey,
-      { activate: opts.activate !== false, revokedKeyId: opts.revokedKeyId }
+      { activate: willActivate, revokedKeyId: opts.revokedKeyId }
     ));
   } catch (err) {
     process.stderr.write(
@@ -18095,7 +18660,6 @@ async function storeAndReport(dest, key, auth, opts) {
     );
     return 1;
   }
-  const active = opts.activate !== false;
   process.stdout.write(
     `
   \u2714 Stored the new key in your ${describeEntryStoreNoun(entry)} \u2014 it was not printed.
@@ -18105,9 +18669,19 @@ async function storeAndReport(dest, key, auth, opts) {
       ["principal", entry.principalId || void 0],
       ["key id", entry.keyId],
       ["env", entry.env],
-      ["active", active ? "yes" : "no"]
-    ]) + "\n\n" + (active ? "  Anything that resolves a key through the CLI \u2014 the MCP server included \u2014 now\n  reads this one. No VECTROS_API_KEY needed.\n" : `  Not active. Run \`vectros switch ${entry.alias}\` to use it.
-`)
+      ["active", willActivate ? "yes" : "no"]
+    ]) + "\n\n" + // The plain "now active" note fires only on the activated path. When it
+    // did NOT activate, tenantActivateMessage below is the ONLY explanation —
+    // it already says to run `switch`, AND (unlike a bare "Not active") says
+    // WHY: an explicit --no-activate vs. this call's tenant-safety default.
+    // Saying both here would print two different "run switch" instructions
+    // for one outcome.
+    (willActivate ? "  Anything that resolves a key through the CLI \u2014 the MCP server included \u2014 now\n  reads this one. No VECTROS_API_KEY needed.\n" : "") + tenantActivateMessage({
+      alias: entry.alias,
+      tenant,
+      willActivate,
+      explicitlyDeclined: opts.activate === false
+    })
   );
   return 0;
 }
@@ -19641,6 +20215,19 @@ async function runAssertions(client, bootstrapClient, deps, blueprint, tenantId,
       assertions.push({ name: `issuer:${issuerId}`, ok: false, detail: `getIssuer(${issuerId}) failed: ${errMsg(e)}` });
     }
   }
+  for (const { namespace } of result.namespaceActions) {
+    try {
+      const ns = await bootstrapClient.identity.getNamespace({ namespace, contextId: blueprint.contextId });
+      const ok = ns.namespace === namespace && ns.contextId === blueprint.contextId;
+      assertions.push({
+        name: `namespace:${namespace}`,
+        ok,
+        detail: ok ? `namespace '${namespace}' registered + readable in context '${blueprint.contextId}'` : `getNamespace(${namespace}) returned namespace '${ns.namespace ?? "(none)"}' in context '${ns.contextId ?? "(tenant-wide)"}', expected '${blueprint.contextId}'`
+      });
+    } catch (e) {
+      assertions.push({ name: `namespace:${namespace}`, ok: false, detail: `getNamespace(${namespace}) failed: ${errMsg(e)}` });
+    }
+  }
   return assertions;
 }
 async function runTeardown(client, bootstrapClient, blueprint, machineId, snapshot, result) {
@@ -19753,10 +20340,18 @@ async function runTeardown(client, bootstrapClient, blueprint, machineId, snapsh
       steps.push({ step: `delete issuer ${issuerId}`, ok: false, error: errMsg(e) });
     }
   }
+  for (const { namespace } of result.namespaceActions) {
+    steps.push({
+      step: `delete namespace ${namespace}`,
+      ok: true,
+      skipped: true,
+      error: "namespace deletion requires a root API key (sk_*) \u2014 blueprint-test never holds one; the registration is left in place"
+    });
+  }
   return steps;
 }
 async function runBlueprintHarness(client, input, deps) {
-  const { tenantId, machineId, keep = false, log, remintForContext } = input;
+  const { tenantId, machineId, keep = false, log, remintForContext, remintBootstrapForContext } = input;
   const readExistingKey = async () => void 0;
   const persistMintedKey = async () => {
   };
@@ -19766,6 +20361,9 @@ async function runBlueprintHarness(client, input, deps) {
     log
   );
   const remint = remintForContext ?? (async () => client);
+  const remintBootstrap = remintBootstrapForContext ?? (async () => client);
+  const hasIssuers = (blueprint.issuers ?? []).length > 0;
+  const hasNamespaces = (blueprint.namespaces ?? []).length > 0;
   let contextSnapshot;
   if (remintForContext) {
     try {
@@ -19781,7 +20379,18 @@ async function runBlueprintHarness(client, input, deps) {
   } else {
     contextSnapshot = await captureSnapshot(client, blueprint);
   }
-  const issuerSnapshot = await captureIssuerSnapshot(client);
+  let issuerSnapshot;
+  if (!hasIssuers) {
+    issuerSnapshot = { existingIssuerIds: /* @__PURE__ */ new Set(), failed: false };
+  } else if (remintBootstrapForContext) {
+    try {
+      issuerSnapshot = await captureIssuerSnapshot(await remintBootstrapForContext(blueprint.contextId));
+    } catch (e) {
+      issuerSnapshot = { existingIssuerIds: /* @__PURE__ */ new Set(), failed: !isNotFound(e) };
+    }
+  } else {
+    issuerSnapshot = await captureIssuerSnapshot(client);
+  }
   const snapshot = {
     ...contextSnapshot,
     existingIssuerIds: issuerSnapshot.existingIssuerIds,
@@ -19791,9 +20400,25 @@ async function runBlueprintHarness(client, input, deps) {
   let assertions = [];
   let applyError;
   try {
-    result = await runLoader(client, { blueprint, tenantId, machineId, readExistingKey, persistMintedKey, log, remintForContext });
+    result = await runLoader(client, {
+      blueprint,
+      tenantId,
+      machineId,
+      readExistingKey,
+      persistMintedKey,
+      log,
+      remintForContext,
+      remintBootstrapForContext
+    });
     log.debug({ component: "harness", contextId: result.contextId, keyName: result.keyName }, "applied");
-    assertions = await runAssertions(await remint(blueprint.contextId), client, deps, blueprint, tenantId, result);
+    assertions = await runAssertions(
+      await remint(blueprint.contextId),
+      hasIssuers || hasNamespaces ? await remintBootstrap(blueprint.contextId) : client,
+      deps,
+      blueprint,
+      tenantId,
+      result
+    );
   } catch (e) {
     applyError = errMsg(e);
     log.warn({ component: "harness", err: applyError }, "apply phase failed");
@@ -19805,7 +20430,14 @@ async function runBlueprintHarness(client, input, deps) {
       tdClient = await remint(blueprint.contextId);
     } catch {
     }
-    teardown = await runTeardown(tdClient, client, blueprint, machineId, snapshot, result);
+    let tdBootstrapClient = client;
+    if (hasIssuers) {
+      try {
+        tdBootstrapClient = await remintBootstrap(blueprint.contextId);
+      } catch {
+      }
+    }
+    teardown = await runTeardown(tdClient, tdBootstrapClient, blueprint, machineId, snapshot, result);
   }
   const passed = applyError === void 0 && assertions.length > 0 && assertions.every((a) => a.ok);
   return {
@@ -19879,6 +20511,13 @@ async function runBlueprintTest(fileOrName, opts, deps = {}) {
       process.stderr.write(`  \u2716 Scope gate refused blueprint:
 `);
       for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+      return 2;
+    }
+    if (err instanceof CapabilityGateError) {
+      process.stderr.write(`  \u2716 Capability gate refused blueprint:
+`);
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
       return 2;
     }
@@ -19914,9 +20553,22 @@ async function runBlueprintTest(fileOrName, opts, deps = {}) {
           environment: auth.baseUrl
         });
       };
+      const remintBootstrapForContext = async (contextId) => {
+        const ctxToken = await mintBridgeToken({
+          cognitoToken: auth.cognitoToken,
+          apiBaseUrl: auth.baseUrl,
+          contextId,
+          tenant: auth.tenant,
+          useScopedToken: opts.useScopedToken
+        });
+        return new VectrosClient({
+          token: ctxToken.token,
+          environment: auth.baseUrl
+        });
+      };
       const report = await runBlueprintHarness(
         client,
-        { blueprint, tenantId, machineId, keep: opts.keep, log, remintForContext },
+        { blueprint, tenantId, machineId, keep: opts.keep, log, remintForContext, remintBootstrapForContext },
         { pingWithKey }
       );
       if (opts.json) {
@@ -19997,9 +20649,10 @@ async function runJoin(opts, deps = {}) {
     return 2;
   }
   const context = opts.contextArg;
+  const tenant = opts.tenant ?? "live";
   let alias;
   try {
-    alias = keyringAliasFor(opts.alias ?? context, opts.tenant ?? "live");
+    alias = keyringAliasFor(opts.alias ?? context, tenant);
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
@@ -20034,8 +20687,23 @@ async function runJoin(opts, deps = {}) {
       const heldSecret = existingEntry ? await keyring.resolveSecret(alias) : void 0;
       const canReuse = existingEntry && heldSecret && existingEntry.context === context && existingEntry.principalId === principalId && existingEntry.env === auth.env;
       if (canReuse && existingEntry) {
-        await keyring.setActive(alias);
-        emitJoined(alias, context, principalId, opts.role, existingEntry.keyId, true);
+        const willActivate2 = await determineActivateDecision(keyring, {
+          tenant,
+          explicitActivate: opts.activate,
+          hint: { alias, secret: heldSecret }
+        });
+        if (willActivate2) await keyring.setActive(alias);
+        emitJoined({
+          alias,
+          context,
+          principalId,
+          role: opts.role,
+          keyId: existingEntry.keyId,
+          reused: true,
+          tenant,
+          willActivate: willActivate2,
+          explicitlyDeclined: opts.activate === false
+        });
         return 0;
       }
       warnReplacingAlias(existingEntry, alias);
@@ -20047,13 +20715,24 @@ async function runJoin(opts, deps = {}) {
         );
       }
       if (revokedKeyId) await warnOtherAliasesNaming(keyring, revokedKeyId, alias);
+      const willActivate = await determineActivateDecision(keyring, { tenant, explicitActivate: opts.activate });
       const { entry } = await storeMintedKey(
         keyring,
         { alias, context, principalId, role: opts.role, keyId: key.keyId, env: auth.env },
         key.rawKey,
-        { revokedKeyId }
+        { activate: willActivate, revokedKeyId }
       );
-      emitJoined(alias, context, principalId, opts.role, entry.keyId, false);
+      emitJoined({
+        alias,
+        context,
+        principalId,
+        role: opts.role,
+        keyId: entry.keyId,
+        reused: false,
+        tenant,
+        willActivate,
+        explicitlyDeclined: opts.activate === false
+      });
       return 0;
     } catch (err) {
       process.stderr.write(formatCliError(err, { action: "join failed" }));
@@ -20061,27 +20740,34 @@ async function runJoin(opts, deps = {}) {
     }
   });
 }
-function emitJoined(alias, context, principalId, role, keyId, reused) {
-  process.stdout.write(
-    `
-  \u2714 Joined '${context}' as ${principalId}` + (reused ? " (existing key reused)" : "") + "\n" + formatKeyValues([
-      ["alias", alias],
-      ["context", context],
-      ["principal", principalId],
-      ["role", role],
-      ["key id", keyId]
-    ]) + `
+function emitJoined(opts) {
+  const header = `
+  \u2714 Joined '${opts.context}' as ${opts.principalId}` + (opts.reused ? " (existing key reused)" : "") + "\n" + formatKeyValues([
+    ["alias", opts.alias],
+    ["context", opts.context],
+    ["principal", opts.principalId],
+    ["role", opts.role],
+    ["key id", opts.keyId]
+  ]);
+  const activationNote = opts.willActivate ? `
 
-  Now active. Use \`vectros switch ${alias}\` to return to it, \`vectros keyring show --format env\` to export the key for the MCP server.
-`
+  Now active. Use \`vectros switch ${opts.alias}\` to return to it, \`vectros keyring show --format env\` to export the key for the MCP server.
+` : "";
+  process.stdout.write(
+    header + activationNote + tenantActivateMessage({
+      alias: opts.alias,
+      tenant: opts.tenant,
+      willActivate: opts.willActivate,
+      explicitlyDeclined: opts.explicitlyDeclined
+    })
   );
 }
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.15.0" : "dev",
-  sdk: true ? "0.39.0" : "dev",
-  blueprints: true ? "0.12.0" : "dev"
+  cli: true ? "0.16.0" : "dev",
+  sdk: true ? "0.40.0" : "dev",
+  blueprints: true ? "0.13.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -20105,6 +20791,14 @@ function addCommonAuthOptions(cmd) {
     "emit machine-readable JSON instead of the human-readable view"
   );
 }
+function parseTenantFlag(raw) {
+  if (raw !== void 0 && raw !== "test" && raw !== "live") {
+    process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${raw}')
+`);
+    process.exit(2);
+  }
+  return raw;
+}
 function toCommonOptions(flags) {
   return {
     env: flags.env,
@@ -20158,7 +20852,10 @@ function buildProgram(deps = {}) {
   return program;
 }
 function registerJoinCommand(program, deps) {
-  const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (XOR --actions)").option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
+  const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (XOR --actions)").option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option(
+    "--activate",
+    "force the freshly-stored key to become your active identity, even over a currently-active LIVE credential (the one case --tenant test does NOT do automatically)"
+  ).option("--no-activate", "store the key without activating it, regardless of tenant");
   addAuthOptions(join3).action(
     async (contextArg, flags) => {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
@@ -20176,7 +20873,8 @@ function registerJoinCommand(program, deps) {
             as: flags.as,
             scope: flags.scope,
             alias: flags.alias,
-            tenant: flags.tenant
+            tenant: flags.tenant,
+            activate: flags.activate
           },
           deps
         )
@@ -20423,9 +21121,10 @@ function toKeyDestination(flags) {
 function registerKeyCommands(program, deps) {
   const key = program.command("key").description("Manage scoped API keys (ssk_*) \u2014 issue, list, revoke, rotate.");
   const issue = addKeyDestinationOptions(
-    key.command("issue").description("Mint an ssk_* for a principal that already has a profile in the context.").requiredOption("--principal <p>", "principal (usr_<id> or <id>) with an AccessProfile in the context").requiredOption("--context <c>", "app context the key operates in").option("--name <name>", "key name (idempotency tuple component)", DEFAULT_KEY_NAME).option("--label <label>", "optional principal label (surfaced in /v1/ping)")
+    key.command("issue").description("Mint an ssk_* for a principal that already has a profile in the context.").requiredOption("--principal <p>", "principal (usr_<id> or <id>) with an AccessProfile in the context").requiredOption("--context <c>", "app context the key operates in").option("--name <name>", "key name (idempotency tuple component)", DEFAULT_KEY_NAME).option("--label <label>", "optional principal label (surfaced in /v1/ping)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)")
   );
   addAuthOptions(issue).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
     process.exit(
       await runKeyIssue({
         ...toCommonOptions(flags),
@@ -20433,6 +21132,7 @@ function registerKeyCommands(program, deps) {
         context: flags.context,
         name: flags.name,
         label: flags.label,
+        tenant,
         ...toKeyDestination(flags)
       }, deps)
     );
@@ -20440,37 +21140,50 @@ function registerKeyCommands(program, deps) {
   const list = key.command("list").description("List active scoped keys in one context (default, or --context <id>); --all-contexts for every context.").option("--principal <p>", "only keys for this principal (usr_<id> or <id>)").option("--context <c>", "only keys in this context (default: the default context)").option(
     "--all-contexts",
     "list every key across ALL your contexts (owner-only) \u2014 the tenant-wide view for the key limit"
-  );
+  ).option("--tenant <tenant>", "tenant to list: 'test' or 'live' (default live; not combinable with --all-contexts)");
   addCommonAuthOptions(list).action(
     async (flags) => {
+      if (flags.allContexts && flags.tenant !== void 0) {
+        process.stderr.write("  \u2716 --tenant is not combinable with --all-contexts (which already spans both tenants).\n");
+        process.exit(2);
+      }
+      const tenant = parseTenantFlag(flags.tenant);
       process.exit(
         await runKeyList(
           {
             ...toCommonOptions(flags),
             principal: flags.principal,
             context: flags.context,
-            allContexts: Boolean(flags.allContexts)
+            allContexts: Boolean(flags.allContexts),
+            tenant
           },
           deps
         )
       );
     }
   );
-  const get = key.command("get").description("Show one key\u2019s metadata (no secret).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)");
-  addCommonAuthOptions(get).action(async (keyId, flags) => {
-    process.exit(await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context }, deps));
-  });
-  const revoke = key.command("revoke").description("Revoke a key (soft-delete; ~5 min to take effect).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)");
-  addAuthOptions(revoke).action(async (keyId, flags) => {
-    process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context }, deps));
-  });
+  const get = key.command("get").description("Show one key\u2019s metadata (no secret).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(get).action(
+    async (keyId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+    }
+  );
+  const revoke = key.command("revoke").description("Revoke a key (soft-delete; ~5 min to take effect).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)");
+  addAuthOptions(revoke).action(
+    async (keyId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+    }
+  );
   const rotate = addKeyDestinationOptions(
     key.command("rotate").description("Revoke the matching active key and mint a fresh secret.").requiredOption("--principal <p>", "principal (usr_<id> or <id>)").requiredOption("--context <c>", "app context").option("--name <name>", "key name to rotate", DEFAULT_KEY_NAME).option(
       "--force-new",
       "mint a new key even though other active keys already exist for this principal/context under a different name (bypasses the default-name-mismatch guard)"
-    )
+    ).option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)")
   );
   addAuthOptions(rotate).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
     process.exit(
       await runKeyRotate({
         ...toCommonOptions(flags),
@@ -20478,6 +21191,7 @@ function registerKeyCommands(program, deps) {
         context: flags.context,
         name: flags.name,
         forceNew: flags.forceNew,
+        tenant,
         ...toKeyDestination(flags)
       }, deps)
     );