@vectros-ai/cli 0.15.0 → 0.19.0

package/dist/cli.js

@@ -4103,7 +4103,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/admin/keys/scoped");
   }
   /**
-   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. A root API key (`sk_`) is exempt from both bounds.
+   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. Minting a key bound to your OWN principal needs nothing further; minting one bound to a DIFFERENT principal additionally requires the `delegate-mint` capability (`granted_capabilities`) on your credential — without it the request is refused. A root API key (`sk_`) is exempt from all three bounds.
    *
    * @param {Vectros.CreateScopedKeyRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4435,7 +4435,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope, and applies the same `identityOverrides` bounds the update endpoint documents — a scoped credential may not repoint or clear an identity value it does not itself hold). You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
+   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope, and applies the same `identityOverrides` bounds the update endpoint documents — a scoped credential may not repoint or clear an identity value it does not itself hold). The `principalId` must name a principal that already exists: a `usr_` principal must be a live user in your tenant, so create the user before granting it a profile. A `usr_` id that names no such user is rejected, and no profile is created. `key_` principals are not checked this way. You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
    *
    * @param {Vectros.CreateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5536,7 +5536,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access.
+   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access. **A token confined to a single app context sees only that context's usage**: totals, the environment split, and the `contexts` breakdown narrow to it, and the environment your context is not bound to is omitted (`null`), not zeroed. Only a token with cross-context reach sees your full account-wide totals. Two exceptions to the narrowing, since they have no per-context breakdown to narrow to: `reads.calls.used`/`reads.dataOut.bytes` (metered per account, not per context) read as `0` for a confined token rather than a narrowed figure — the corresponding overage-credit charge fields narrow correctly; and `credits.limit` stays your whole plan's ceiling, so `credits.remaining` may overstate the account's true remaining room.
    *
    * @param {Vectros.GetUsageRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5599,7 +5599,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/usage");
   }
   /**
-   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability.
+   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key sees every context. An ordinary bootstrap credential that didn't specify a context resolves to the `default` app context specifically, not every context — so this call returns 404 for an issuer registered under any other context unless you re-minted the bootstrap token pinned to that context.
    *
    * @param {Vectros.GetIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5657,13 +5657,81 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. Unconditional — unlike some other registry deletes on this API, this does not check for or block on any downstream reference. Any user account already created via this issuer (by a prior self-signup or accepted invite) is NOT deleted or modified, but that user can no longer obtain a NEW token this way once you deregister the issuer — every `POST /v1/auth/token/exchange` call against it will 404, with no distinction between an unknown issuer and one you just deregistered. Register a replacement issuer, or restore this one, before your users' current tokens expire if you want their access to continue uninterrupted.
+   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `status` (`active`/`suspended` — a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
+   *
+   * @param {Vectros.IssuerUpdateRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.updateIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  updateIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateIssuer(request, requestOptions));
+  }
+  async __updateIssuer(request, requestOptions) {
+    const { issuerId, ..._body } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "PUT",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: _body,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/auth/issuers/{issuerId}");
+  }
+  /**
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. Deactivate the affected users first if you intend to cut off their access, or register a replacement issuer before removing this one. An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
    *
    * @param {Vectros.DeleteIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5705,6 +5773,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5723,7 +5793,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. Returns a `{data, nextCursor}` envelope.
+   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only the issuers registered in that context; a root API key sees every context. An ordinary bootstrap credential that didn't specify a context resolves to the `default` app context specifically, not every context — so this call returns an empty page for a tenant whose issuers are all registered under a different context unless you re-minted the bootstrap token pinned to that context. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListIssuersRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5780,7 +5850,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
   }
   /**
-   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant.
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`.
    *
    * @param {Vectros.IssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5891,7 +5961,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/ping");
   }
   /**
-   * Returns the access profiles for the given principal across all of your contexts. Use this to answer questions like "which apps does this user have access to?" — for example, to build a member-access summary. Results are confined to your account. Requires the `profiles:r` scope.
+   * Returns the access profiles for the given principal. Looking up your OWN principal — or holding the `context-directory-read` capability — returns the profiles across ALL of your contexts, letting you answer questions like "which apps does this user have access to?". A context-bound credential looking up a DIFFERENT principal instead sees only that principal's profile in your credential's own context (at most one result), never across contexts it has no authority over. Results are always confined to your account. Requires the `profiles:r` scope.
    *
    * @param {Vectros.ListProfilesForPrincipalRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5965,6 +6035,7 @@ var AuthClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -6018,6 +6089,8 @@ var AuthClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -6031,7 +6104,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token");
   }
   /**
-   * Invite a new member to one of your app contexts by email. Creates a pending user with a pre-resolved access profile (their permissions on accept) and signs an invitation token. This call is idempotent on the combination of context and email: re-inviting the same email in the same context rotates the token and resends the invitation rather than creating a duplicate — this requires the `users:r` and `users:u` scopes in addition to `users:c`, because resending rotates a credential on an existing invitation and invalidates any link already sent. Without them the collision returns 409 instead, with no invitation details and no change to the outstanding invitation. Returns HTTP 201 on a new invite or a successful resend. Returns 409 if that email already belongs to an active or suspended member of the app context, or already has an identity elsewhere in your account (an email can currently belong to only one tenant per account, i.e. your test and live environments cannot share an email). When `sendEmail` is false, the response includes the raw token and a ready-to-use accept link so you can deliver the invitation through your own email provider. Requires the `users:c` scope.
+   * Invite a new member to one of your app contexts by email, OR grant an existing member access to an additional app context by inviting their same email again. Idempotent on the combination of context and email: re-inviting the same email into the SAME context rotates the token and resends the invitation rather than creating a duplicate — this requires the `users:r` and `users:u` scopes in addition to `users:c`, because resending rotates a credential on an existing invitation and invalidates any link already sent. Without them the collision returns 409 instead, with no invitation details and no change to the outstanding invitation. Inviting the SAME email into a DIFFERENT app context in this tenant, where that email already resolves to an existing member: if that member is active AND already has (or, once accepted, will have) a credential that works for the new context's own identity provider, this immediately grants them access to the new context (no email is sent — there is nothing to accept, `emailSent` is false) — this additionally requires the `users:r` scope (no `users:u`, since nothing is mutated), because the response names the existing member's userId, a fact about them your credential could not otherwise learn through this endpoint. If that active member's ONLY existing credential is for a DIFFERENT identity provider than the one the new context uses, a normal, independent invitation is created instead (its own new member id, a real token/accept link) — attaching them silently would leave no way for them to ever actually sign in to that context. If the existing member's original invitation is still pending, this attaches the new context's access to that same outstanding invitation and rotates its token (`users:r`+`users:u`, same as an ordinary resend — both the disclosure and the credential rotation apply here). A SUSPENDED member's email does not get new-context access this way — reactivate them explicitly first. Returns HTTP 201 in every one of those cases. Returns 409 if that email already belongs to an active or suspended member of THIS specific app context, already has a PENDING invitation for THIS specific app context, or resolves to an existing member elsewhere in the tenant and your token lacks the additional scope the grant/attach requires (`users:r`, or `users:r`+`users:u` for the still-pending case). An email that already has an identity in your OTHER tenant (test vs. live) is not a collision either — it creates an additional, independent membership in this tenant for that same identity. When `sendEmail` is false, the response includes the raw token and a ready-to-use accept link so you can deliver the invitation through your own email provider. Requires the `users:c` scope.
    *
    * @param {Vectros.CreateInviteRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6170,7 +6243,84 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/invite/resend");
   }
   /**
-   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
+   * Re-mints the presented `st_*` scoped token with one or more `identity.<namespace>` values changed — for a caller whose ROLE explicitly grants assuming those values (an invited hr-admin, a multi-org case-handler) and needs to change which value new writes place records under. The request body names one or more namespaces in canonical `scope:<namespace>` form, e.g. `{"scope:org": "orgB"}` — each value must be a plain literal, never a `${{ ... }}` placeholder. When you name MORE THAN ONE namespace, a single one of your roles must grant all of them together: the combination is never assembled from two different roles, because no role author would have vouched for it. `st_*`-only — a root API key or `ssk_*` scoped API key gets 403; neither needs this (root already has full authority, and an `ssk_*`'s identity shape is not what this resolves against).
+   *
+   * **Only an original token may assume.** A token produced BY this endpoint cannot assume again (403) — every assume starts from the token you exchanged for, so the identity you end up with is always one a single role explicitly granted rather than a combination reached by chaining calls. Keep your original token if you need to switch more than once, or exchange for a new one.
+   *
+   * **Entitlement is checked LIVE, against your roles as they are right now** — not against a copy frozen into your token when it was minted. The requested value must be explicitly granted by a role's `assumable` field for that namespace: a POINT check against the one value requested, and a deliberately separate, explicitly-authored question from what the role's `data_scope` permits reading or writing. Holding broad `data_scope` reach in a namespace does NOT by itself grant assuming any value in it.
+   *
+   * **What is preserved, and what is not.** Every clause of your token that does not reference a requested namespace is preserved verbatim, as are all other claims (`partner_user_id`, `context_id`, mint attribution). Clauses that DO reference a requested namespace are kept only if they come from a role that authorized the new value. A role that does not authorize it loses all of its clauses touching that namespace — including any scoped to the value you already held. Assume into a value one role grants and you keep that role's reach, not the reach of roles that never vouched for it.
+   *
+   * The re-minted token's `exp` is IDENTICAL to the presented token's — this call can never extend a session's life. A fresh, independently-revocable `jti` is stamped on every call, and (except when the presented token predates jti support and has none to chain from) the token also carries a `root_jti` revocation-lineage claim so revoking the token you started from closes every value ever assumed from it. Uses the ordinary Vectros `{"message":...}` error shape, not the OAuth envelope `POST /v1/auth/token/exchange` uses — this endpoint's caller is always Vectros-SDK code already holding a bearer token, never generic OAuth tooling.
+   *
+   * @param {Record<string, unknown>} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.UnauthorizedError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.ConflictError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.assumeToken({
+   *         "scope:org": "orgB"
+   *     })
+   */
+  assumeToken(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__assumeToken(request, requestOptions));
+  }
+  async __assumeToken(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/token/assume"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 401:
+          throw new UnauthorizedError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token/assume");
+  }
+  /**
+   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. If your issuer is registered against more than one app context (each via its own audience), `context_id` selects which one to target; omit it when your token's `aud` claim matches only one registered context — the common case, unaffected by this field. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
    *
    * @param {Vectros.TokenExchangeRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6246,9 +6396,9 @@ var ComplianceClient = class {
    * @param {Vectros.ErasureRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.TooManyRequestsError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.compliance.createErasureRequest({
@@ -6287,12 +6437,12 @@ var ComplianceClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -6311,7 +6461,6 @@ var ComplianceClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.compliance.getErasureRequest({
@@ -6352,8 +6501,6 @@ var ComplianceClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -7712,6 +7859,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.listEntities({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         startFrom: "b3BhcXVlLWN1cnNvci1mcm9tLXRoZS1wcmV2aW91cy1wYWdl"
    *     })
    */
@@ -7721,6 +7869,7 @@ var IdentityClient = class {
   async __listEntities(request, requestOptions) {
     const {
       namespace,
+      contextId,
       userId,
       externalId,
       scope,
@@ -7735,6 +7884,7 @@ var IdentityClient = class {
       limit
     } = request;
     const _queryParams = {
+      contextId,
       userId,
       externalId,
       scope,
@@ -7793,6 +7943,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.createEntity({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         body: {
    *             externalId: "team_eng_platform"
    *         }
@@ -7802,9 +7953,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__createEntity(request, requestOptions));
   }
   async __createEntity(request, requestOptions) {
-    const { namespace, upsert, body: _body } = request;
+    const { namespace, upsert, contextId, body: _body } = request;
     const _queryParams = {
-      upsert
+      upsert,
+      contextId
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -7861,14 +8013,18 @@ var IdentityClient = class {
    * @example
    *     await client.identity.getEntity({
    *         namespace: "team",
-   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
+   *         contextId: "myapp"
    *     })
    */
   getEntity(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__getEntity(request, requestOptions));
   }
   async __getEntity(request, requestOptions) {
-    const { namespace, id } = request;
+    const { namespace, id, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7882,7 +8038,7 @@ var IdentityClient = class {
       ),
       method: "GET",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -7919,6 +8075,7 @@ var IdentityClient = class {
    *     await client.identity.updateEntity({
    *         namespace: "team",
    *         id: "id",
+   *         contextId: "myapp",
    *         body: {
    *             externalId: "team_eng_platform"
    *         }
@@ -7928,7 +8085,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__updateEntity(request, requestOptions));
   }
   async __updateEntity(request, requestOptions) {
-    const { namespace, id, body: _body } = request;
+    const { namespace, id, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7943,7 +8103,7 @@ var IdentityClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -7983,14 +8143,18 @@ var IdentityClient = class {
    * @example
    *     await client.identity.deleteEntity({
    *         namespace: "team",
-   *         id: "id"
+   *         id: "id",
+   *         contextId: "myapp"
    *     })
    */
   deleteEntity(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__deleteEntity(request, requestOptions));
   }
   async __deleteEntity(request, requestOptions) {
-    const { namespace, id } = request;
+    const { namespace, id, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8004,7 +8168,7 @@ var IdentityClient = class {
       ),
       method: "DELETE",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8047,6 +8211,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.lookupEntities({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         body: {
    *             type: "person_v1",
    *             field: "ssn"
@@ -8057,7 +8222,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__lookupEntities(request, requestOptions));
   }
   async __lookupEntities(request, requestOptions) {
-    const { namespace, body: _body } = request;
+    const { namespace, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8072,7 +8240,7 @@ var IdentityClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -8116,15 +8284,17 @@ var IdentityClient = class {
    * @example
    *     await client.identity.getEntityVersions({
    *         namespace: "team",
-   *         id: "id"
+   *         id: "id",
+   *         contextId: "myapp"
    *     })
    */
   getEntityVersions(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__getEntityVersions(request, requestOptions));
   }
   async __getEntityVersions(request, requestOptions) {
-    const { namespace, id, startFrom } = request;
+    const { namespace, id, contextId, startFrom } = request;
     const _queryParams = {
+      contextId,
       startFrom
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
@@ -8170,7 +8340,7 @@ var IdentityClient = class {
     );
   }
   /**
-   * Retrieves a single scope-namespace registration by name. The reserved built-ins `org` and `client` are always resolvable.
+   * Retrieves a single scope-namespace registration by name.
    *
    * @param {Vectros.GetNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8186,7 +8356,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__getNamespace(request, requestOptions));
   }
   async __getNamespace(request, requestOptions) {
-    const { namespace } = request;
+    const { namespace, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8200,7 +8373,7 @@ var IdentityClient = class {
       ),
       method: "GET",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8225,7 +8398,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces/{namespace}");
   }
   /**
-   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`, `specificityRank`) of a registered namespace. The namespace name itself is immutable. Requires a root API key. The reserved built-ins cannot be updated.
+   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`, `specificityRank`) of a registered namespace. The namespace name and its `contextId` (which row is selected) are both immutable. Requires a root API key. `org` and `client` are updatable like any other namespace — there is no reserved-built-in exception.
    *
    * @param {Vectros.UpdateNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8247,7 +8420,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__updateNamespace(request, requestOptions));
   }
   async __updateNamespace(request, requestOptions) {
-    const { namespace, body: _body } = request;
+    const { namespace, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8262,7 +8438,7 @@ var IdentityClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -8293,7 +8469,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/namespaces/{namespace}");
   }
   /**
-   * Deletes a registered scope namespace. Requires a root API key. The reserved built-ins cannot be deleted. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
+   * Deletes a registered scope namespace. Requires a root API key. `org` and `client` are deletable like any other namespace — there is no reserved-built-in exception. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
    *
    * @param {Vectros.DeleteNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8311,7 +8487,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__deleteNamespace(request, requestOptions));
   }
   async __deleteNamespace(request, requestOptions) {
-    const { namespace } = request;
+    const { namespace, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8325,7 +8504,7 @@ var IdentityClient = class {
       ),
       method: "DELETE",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8354,7 +8533,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/namespaces/{namespace}");
   }
   /**
-   * Returns the scope namespaces registered in your account, with the reserved built-ins `org` and `client` listed first. Returns a `{data, nextCursor}` envelope.
+   * Returns the scope namespaces registered in your account. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListNamespacesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8366,10 +8545,11 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__listNamespaces(request, requestOptions));
   }
   async __listNamespaces(request = {}, requestOptions) {
-    const { startFrom, limit } = request;
+    const { startFrom, limit, contextId } = request;
     const _queryParams = {
       startFrom,
-      limit
+      limit,
+      contextId
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -8404,9 +8584,9 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces");
   }
   /**
-   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key. The reserved names `org` and `client` are built in and cannot be registered.
+   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary partner-grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and `contextId` is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). `org` and `client` are reserved names, registered the same way as any other namespace.
    *
-   * @param {Vectros.NamespaceRequest} request
+   * @param {Vectros.RegisterNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
@@ -8415,14 +8595,20 @@ var IdentityClient = class {
    *
    * @example
    *     await client.identity.registerNamespace({
-   *         namespace: "team",
-   *         specificityRank: 1500
+   *         body: {
+   *             namespace: "team",
+   *             specificityRank: 1500
+   *         }
    *     })
    */
   registerNamespace(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__registerNamespace(request, requestOptions));
   }
   async __registerNamespace(request, requestOptions) {
+    const { contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -8437,9 +8623,9 @@ var IdentityClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
-      body: request,
+      body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -8468,7 +8654,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/namespaces");
   }
   /**
-   * Returns a paginated list of the users in your account. Pass `externalId` to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply `type` and `field` together with one lookup mode: `value` (exact match), `from`+`to` (range), or `prefix`. Requires the `users:r` scope.
+   * Returns a paginated list of the users in your account. Pass `externalId` to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply `type` and `field` together with one lookup mode: `value` (exact match), `from`+`to` (range), or `prefix`. Requires the `users:r` scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.
    *
    * @param {Vectros.ListUsersRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8533,7 +8719,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users");
   }
   /**
-   * Creates a user identity in your account. The operation is idempotent on `externalId`: if a user with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set `?upsert=true` (this also requires the `users:u` scope). Requires the `users:c` scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the `users:r` scope — a credential holding `users:c` alone receives a `400` ("already exists") on collision instead of the user.
+   * Creates a user identity in your account. The operation is idempotent on `externalId`: if a user with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set `?upsert=true` (this also requires the `users:u` scope). Requires the `users:c` scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the `users:r` scope — a credential holding `users:c` alone receives a `400` ("already exists") on collision instead of the user. A context-confined credential additionally receives the collision echo (or, with `?upsert=true`, is allowed to overwrite) only when the colliding user holds an access profile in the credential's own app context — a cross-context collision otherwise gets the same uniform `400` instead of the other context's user data. One narrow exception on the plain (non-upsert) echo only: the CLI's no-code bootstrap credential can be echoed a colliding user across app contexts, needed for a blueprint to idempotently re-apply against a service principal it provisioned in a non-default context; this does not extend to `?upsert=true`.
    *
    * @param {Vectros.CreateUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8657,7 +8843,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/{id}");
   }
   /**
-   * Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The `type` field is immutable after creation, and `email` cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries `inviteToken`, `externalSubject`, and `emailVerifiedAttestation=true` completes the invitation. Requires the `users:u` scope.
+   * Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The `type` field is immutable after creation, and `email` cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries `inviteToken`, `externalSubject`, and `emailVerifiedAttestation=true` completes the invitation. **`externalSubject` set this way is NOT an authentication binding and does not enable sign-in anywhere** — not the Vectros DevPortal/Admin App/web apps, and not `/v1/auth/token/exchange` either; both are granted only by the invitee authenticating themselves. If the invitee needs dev-portal/web-app access, send them the invitation link and let them accept it directly. If the invitee needs to sign in via token exchange, have them redeem `inviteToken` themselves at `/v1/auth/token/exchange` with their own credential — Vectros verifies it there and computes its own value for this field from the verified credential. The value you send here is stored exactly as-is, with no normalization, and does NOT automatically match or deduplicate against what a later token-exchange sign-in computes for the same real-world identity. Call this endpoint directly only if you run your own backend and want Vectros to record which of your own users a given account corresponds to — treat this field as informational for that purpose, not as a way to pre-authorize sign-in. Requires the `users:u` scope.
    *
    * @param {Vectros.UpdateUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8724,12 +8910,13 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/users/{id}");
   }
   /**
-   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope.
+   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner. Called by a context-confined credential, deletion is also refused (409) when the user holds access in an app context other than the caller's own — remove the user from the caller's own context first, or use a credential with cross-context reach.
    *
    * @param {Vectros.DeleteUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8769,6 +8956,8 @@ var IdentityClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -8782,7 +8971,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/users/{id}");
   }
   /**
-   * Looks up users by a schema lookup field, with the query criteria carried in the request body rather than the URL. Use this when looking up by a sensitive (blind-indexed) field: the value is blind-indexed server-side and never appears in the URL, request logs, or proxies. The query semantics are identical to the GET /v1/users lookup, which rejects sensitive-field values and directs you here. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
+   * Looks up users by a schema lookup field, with the query criteria carried in the request body rather than the URL. Use this when looking up by a sensitive (blind-indexed) field: the value is blind-indexed server-side and never appears in the URL, request logs, or proxies. The query semantics are identical to the GET /v1/users lookup, which rejects sensitive-field values and directs you here. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.
    *
    * @param {Vectros.IdentityLookupRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -9225,14 +9414,14 @@ var RecordsClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Reserved endpoint for fetching multiple records by ID in one call. When available, the response will contain only the records you can see; any IDs that do not exist or are outside your scope are silently omitted (there is no per-ID existence signal), matching the not-found behavior of the single-record GET. It currently returns 501 (not implemented). The documented 200 response schema is the stable shape this endpoint will use once available. Requires the `records:r` scope.
+   * Fetches multiple records by ID in one call (`ids`, maximum 100). The response contains only the records you can access — any id that does not exist, belongs to another account/AppContext, or is outside your token's scope is silently omitted, with no per-id existence signal, matching the not-found behavior of the single-record GET. Payloads are hydrated the same way a by-id GET hydrates them (payloads externalized to object storage are rehydrated for this response). Requires the `records:r` scope (and, for a scoped token, `records:r:<type>` per record type).
    *
    * @param {Vectros.BatchGetRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.TooManyRequestsError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.records.batchGetRecords()
@@ -9269,12 +9458,12 @@ var RecordsClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -10088,7 +10277,7 @@ var SchemasClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `scope` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by an identity surface (`user` or `entity`) lists your account-wide identity schemas regardless of the calling context; filtering by record or document lists within the calling context. Requires the `schemas:r` scope.
+   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `scope` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by `surface=user` lists your account-wide identity schemas regardless of the calling context (a `user`-surfaced schema always has one tenant-wide home). Filtering by `surface=entity` reads your own app context's entity schemas AND the tenant-wide home together, newest first, through a single cursor — an entity schema may live in either home depending on where its namespace is placed (see `POST /v1/namespaces`). Filtering by `record` or `document` lists within the calling context only. Requires the `schemas:r` scope.
    *
    * @param {Vectros.ListSchemasRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10376,6 +10565,7 @@ var SchemasClient = class {
    * @param {Vectros.DeleteSchemaRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
@@ -10415,6 +10605,8 @@ var SchemasClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 409:
@@ -10851,10 +11043,58 @@ var BlueprintSchemaSchema = import_zod.z.object({
     });
   }
 });
+var CAPABILITY_NAME_RE = /^[a-z][a-z0-9-]*$/;
+var GrantedCapabilitiesSchema = import_zod.z.array(import_zod.z.string().min(1)).optional().superRefine((caps, ctx) => {
+  if (!caps) return;
+  const seen = /* @__PURE__ */ new Set();
+  caps.forEach((name, i) => {
+    if (name === "") return;
+    if (name === "*") {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [i],
+        message: "'*' is not a capability \u2014 granted_capabilities has no wildcard, and a '*' in allowedActions confers zero capabilities. Name each capability explicitly."
+      });
+    } else if (!CAPABILITY_NAME_RE.test(name)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [i],
+        message: `'${name}' is not a valid capability name (expected lowercase letters, digits and hyphens, starting with a letter, and no ':' \u2014 a capability is not an action)`
+      });
+    }
+    if (seen.has(name)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [i],
+        message: `'${name}' is declared more than once`
+      });
+    }
+    seen.add(name);
+  });
+});
 var BlueprintAccessProfileSchema = import_zod.z.object({
   // Validated structurally here; the SCOPE GATE (in @vectros-ai/cli) is
   // what enforces the data-plane-only security boundary.
-  allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1),
+  //
+  // Optional now: mutually exclusive with `roleIds` below (the
+  // `.superRefine` on this schema enforces the XOR, mirroring the platform's
+  // own `AccessProfileDB.validateScopesXorRole`). Exactly one of the two
+  // authors this profile's grant.
+  allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1).optional(),
+  // Additive role composition: this profile's effective grant is
+  // each named role's own clauses, concatenated in the order listed, instead of
+  // an inline clause authored here. Every id must name a role this SAME
+  // blueprint declares in `roles` (`lintAccessProfileRoleIds` below — the
+  // authoring-time mirror of the platform's same-`(tenantId, contextId)`
+  // check, trivially satisfied here since a blueprint's own `roles` are
+  // always created in its own `contextId`); duplicates are rejected outright
+  // rather than silently deduplicated. Mutually exclusive
+  // with `allowedActions`/`dataScope`/`capabilities` — a role-referencing
+  // profile has no inline clause of its own to carry a dataScope or
+  // capability grant; author those on the referenced Role instead, where
+  // every profile referencing it picks them up uniformly (mirrors how
+  // `assumable` already works for a `roleId`-referencing profile).
+  roleIds: import_zod.z.array(import_zod.z.string().min(1)).min(1).optional(),
   // Optional ownership binding: { userId: [...], "scope:org": [...], "scope:client": [...] }.
   // A `null` element in a value list is the documented NULL SENTINEL — it
   // grants access to TENANT-LEVEL (owner-less) records IN ADDITION to the
@@ -10882,31 +11122,92 @@ var BlueprintAccessProfileSchema = import_zod.z.object({
   // below (`lintIdentityOverrides`, placeholder-aware — see that function's
   // docstring); this `.min(1)` is only the shape-level "non-blank" guard on
   // the value, not the grammar check.
-  identityOverrides: import_zod.z.record(import_zod.z.string().min(1)).optional()
-}).strict();
-var BlueprintRoleClauseSchema = import_zod.z.object({
-  allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1),
-  dataScope: import_zod.z.record(import_zod.z.array(import_zod.z.union([import_zod.z.string().min(1), import_zod.z.null()]))).optional()
-}).strict();
-var BlueprintRolesSchema = import_zod.z.record(import_zod.z.array(BlueprintRoleClauseSchema).min(1));
-var IDENTITY_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
-var FORBIDDEN_IDENTITY_NAMESPACES = /* @__PURE__ */ new Set(["record", "document", "entity", "user"]);
-var IdentityKindSchema = import_zod.z.string().min(1).superRefine((val, ctx) => {
-  if (val === "user") return;
-  if (!IDENTITY_NAMESPACE_RE.test(val)) {
-    ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
-      message: `kind must be 'user' or an entity namespace (2-32 chars, a lowercase letter first, then lowercase letters/digits/_/-), e.g. 'org', 'client', 'team'`
-    });
-  } else if (FORBIDDEN_IDENTITY_NAMESPACES.has(val)) {
+  identityOverrides: import_zod.z.record(import_zod.z.string().min(1)).optional(),
+  // Optional capabilities granted to the blueprint's own service-principal
+  // profile. DECISION: allowed here, not role-clause-only. On the platform,
+  // an access profile's scopes are themselves a list of clauses — the exact
+  // same wire shape a role clause carries — and the loader already builds
+  // this profile as ONE such clause. Refusing `capabilities` here while
+  // allowing it on a role clause would be an asymmetry this FORMAT package
+  // has no basis to invent: nothing on the platform side distinguishes the
+  // two, and whether granting a capability to a blueprint's own service key
+  // is sound POLICY is exactly the question the CLI's scope gate exists to
+  // answer (a separate package, out of scope for this format layer) — the
+  // same posture this package already takes with `allowedActions` above.
+  //
+  // Worth naming for whoever writes that gate: this profile is a long-lived,
+  // non-human-attributable machine credential (typically stored in CI/CD
+  // secrets), not an ephemeral human session — a materially different
+  // blast-radius question from granting the same capability to a role that
+  // a person is bound to. The gate should weigh the two separately rather
+  // than reuse one policy for both.
+  capabilities: GrantedCapabilitiesSchema
+}).strict().superRefine((ap, ctx) => {
+  const hasInline = ap.allowedActions !== void 0;
+  const hasRoleIds = ap.roleIds !== void 0;
+  if (hasInline === hasRoleIds) {
     ctx.addIssue({
       code: import_zod.z.ZodIssueCode.custom,
-      message: `'${val}' is a reserved surface name and cannot be an entity namespace \u2014 use 'user' for a user, or a namespace like 'org'/'client'/'team'`
+      path: ["roleIds"],
+      message: hasInline ? "accessProfile carries both 'allowedActions' and 'roleIds' \u2014 provide exactly one: an inline clause (allowedActions, optionally dataScope/capabilities) OR a role composition (roleIds), never both" : "accessProfile carries neither 'allowedActions' nor 'roleIds' \u2014 provide exactly one: an inline clause (allowedActions, optionally dataScope/capabilities) OR a role composition (roleIds)"
     });
+    return;
   }
-});
-var IdentityDeclSchema = import_zod.z.object({
-  kind: IdentityKindSchema,
+  if (hasRoleIds) {
+    if (ap.dataScope !== void 0) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: ["dataScope"],
+        message: "accessProfile.dataScope is not valid alongside 'roleIds' \u2014 a role-composed profile has no inline clause of its own; author dataScope on the referenced role's clause instead"
+      });
+    }
+    if (ap.capabilities !== void 0) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: ["capabilities"],
+        message: "accessProfile.capabilities is not valid alongside 'roleIds' \u2014 a role-composed profile has no inline clause of its own; author capabilities on the referenced role's clause instead"
+      });
+    }
+  }
+});
+var BlueprintRoleClauseSchema = import_zod.z.object({
+  allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1),
+  dataScope: import_zod.z.record(import_zod.z.array(import_zod.z.union([import_zod.z.string().min(1), import_zod.z.null()]))).optional(),
+  dataScopeRef: import_zod.z.string().min(1).optional(),
+  capabilities: GrantedCapabilitiesSchema
+}).strict().superRefine((c, ctx) => {
+  if (c.dataScope !== void 0 && c.dataScopeRef !== void 0) {
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      path: ["dataScopeRef"],
+      message: "a clause may declare 'dataScope' OR 'dataScopeRef', not both \u2014 dataScopeRef is sugar for an inline dataScope fragment, so the two are alternatives for the same slot, not additive"
+    });
+  }
+});
+var BlueprintFragmentsSchema = import_zod.z.record(
+  import_zod.z.record(import_zod.z.array(import_zod.z.union([import_zod.z.string().min(1), import_zod.z.null()])))
+);
+var BlueprintRolesSchema = import_zod.z.record(import_zod.z.array(BlueprintRoleClauseSchema).min(1));
+var BlueprintRoleAssumableSchema = import_zod.z.record(import_zod.z.array(import_zod.z.string().min(1)).min(1));
+var BlueprintRoleAssumableMapSchema = import_zod.z.record(BlueprintRoleAssumableSchema);
+var IDENTITY_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
+var FORBIDDEN_IDENTITY_NAMESPACES = /* @__PURE__ */ new Set(["record", "document", "entity", "user"]);
+var IdentityKindSchema = import_zod.z.string().min(1).superRefine((val, ctx) => {
+  if (val === "user") return;
+  if (!IDENTITY_NAMESPACE_RE.test(val)) {
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      message: `kind must be 'user' or an entity namespace (2-32 chars, a lowercase letter first, then lowercase letters/digits/_/-), e.g. 'org', 'client', 'team'`
+    });
+  } else if (FORBIDDEN_IDENTITY_NAMESPACES.has(val)) {
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      message: `'${val}' is a reserved surface name and cannot be an entity namespace \u2014 use 'user' for a user, or a namespace like 'org'/'client'/'team'`
+    });
+  }
+});
+var IdentityDeclSchema = import_zod.z.object({
+  kind: IdentityKindSchema,
   externalId: import_zod.z.string().min(1),
   displayName: import_zod.z.string().min(1).optional(),
   metadata: import_zod.z.record(import_zod.z.unknown()).optional()
@@ -10924,7 +11225,7 @@ var BlueprintServicePrincipalSchema = import_zod.z.object({
 }).strict();
 var ISSUER_ID_RE = CONTEXT_ID_RE;
 var BlueprintIssuerSchema = import_zod.z.object({
-  /** Short slug identifying this issuer within your tenant. Immutable once registered. */
+  /** Short slug identifying this issuer within your account. Immutable once registered. */
   issuerId: import_zod.z.string().regex(ISSUER_ID_RE, {
     message: "issuerId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'auth0-prod')"
   }),
@@ -10939,7 +11240,12 @@ var BlueprintIssuerSchema = import_zod.z.object({
    * this as an ordinary per-API/application default).
    */
   audience: import_zod.z.string().min(1),
-  /** Which app context an exchanged token targets. Must be an existing app context. */
+  /**
+   * Which app context an exchanged token targets. **Must equal the blueprint's own
+   * `contextId`** — an issuer is a trust anchor, so a blueprint may only attach one to the
+   * context it actually provisions. One IdP account serving several contexts needs one entry
+   * per context, each in that context's own blueprint.
+   */
   contextId: import_zod.z.string().regex(CONTEXT_ID_RE, {
     message: "contextId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'casework')"
   }),
@@ -10947,6 +11253,14 @@ var BlueprintIssuerSchema = import_zod.z.object({
   subClaim: import_zod.z.string().min(1).optional(),
   /** The claim carrying the subject's email (first-login invite matching). Platform defaults to 'email' when omitted. */
   emailClaim: import_zod.z.string().min(1).optional(),
+  /**
+   * The IdP's OIDC userinfo endpoint. Optional. Presented tokens are access tokens, which under
+   * OIDC don't carry `email` unless the IdP was specifically configured to add it — if
+   * `emailClaim` misses on the presented token, and `userinfoUri` is configured, Vectros falls
+   * back to calling this endpoint (with the presented token as the bearer credential) and reads
+   * `emailClaim` from its JSON response instead. Omit to leave the fallback disabled.
+   */
+  userinfoUri: import_zod.z.string().min(1).optional(),
   /**
    * Opt-in self-service signup: a list of {signupType, roleId} pairs. When a first-time exchange
    * caller presents no invite token but names a signupType matching one of these (or omits it and
@@ -10966,6 +11280,169 @@ var BlueprintIssuerSchema = import_zod.z.object({
     }).strict()
   ).optional()
 }).strict();
+var BlueprintNamespaceSchema = import_zod.z.object({
+  /** The namespace to register — same grammar as a `scope:<namespace>` key. */
+  namespace: import_zod.z.string().min(1),
+  /**
+   * When `true`, every value in this namespace must resolve to an existing
+   * identity entity (create via `entities:c` at the in-context phase, or a
+   * declared `identities:` entry). When `false`/omitted, values are
+   * free-form strings validated by grammar only.
+   */
+  entityBacked: import_zod.z.boolean().optional(),
+  /**
+   * Request the platform's TENANT-WIDE registration form instead of this
+   * blueprint's own context — visible to every context in the account, not
+   * just the one this blueprint provisions. `false`/omitted (the default)
+   * is the ordinary, context-owned registration every other namespace here
+   * gets. Mutually exclusive with any future context-targeting field this
+   * schema may grow — there is exactly one way to say "not my own context"
+   * today.
+   *
+   * A blueprint declaring this does NOT get it automatically: the applying
+   * credential must separately hold a platform capability granted only to
+   * an account OWNER, and the CLI refuses to even request it unless
+   * explicitly told to (see `--allow-tenant-wide-namespaces`) — no flag,
+   * no request, regardless of what this field says. Setting this to `true`
+   * states the blueprint's INTENT; it is not, on its own, a grant of
+   * anything.
+   */
+  tenantWide: import_zod.z.boolean().optional(),
+  /**
+   * This namespace's position in your account's specificity order (used to
+   * break a tie when a caller holds two scope dimensions at once). Required
+   * by the platform on registration; MUST be unique across every namespace
+   * in the account, including `org` (1000) and `client` (2000) — pick a
+   * value outside that pair, and outside any other namespace this same
+   * account might register (its own, or another blueprint's).
+   */
+  specificityRank: import_zod.z.number().int().min(0).max(1e6),
+  /**
+   * Optional membership backing — declares which record type + field hold
+   * grants of THIS namespace's values. Supply together with
+   * `membershipTargetField`, or omit both. Declaring this grants nobody
+   * anything on its own: a role opts in explicitly with
+   * `${{ member.scope.<namespace> }}` in its `dataScope`.
+   */
+  membershipRecordType: import_zod.z.string().min(1).optional(),
+  /** The field on `membershipRecordType` naming the user a grant is FOR. Required alongside `membershipRecordType`. */
+  membershipTargetField: import_zod.z.string().min(1).optional(),
+  /**
+   * The field on `membershipRecordType` naming a grant's LEVEL, so the same
+   * user can hold different levels in different values of this namespace.
+   * Supply together with `membershipLevels`, or omit both for plain
+   * in-or-out membership.
+   */
+  membershipLevelField: import_zod.z.string().min(1).optional(),
+  /** The complete set of level labels this namespace allows. Required alongside `membershipLevelField`. */
+  membershipLevels: import_zod.z.array(import_zod.z.string().min(1)).optional()
+}).strict();
+var MEMBERSHIP_FIELD_NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
+function lintNamespaces(value, ctx) {
+  if (!value || typeof value !== "object" || !("namespaces" in value)) return;
+  const namespaces = value.namespaces;
+  if (!Array.isArray(namespaces)) return;
+  const rawSchemas = value.schemas;
+  const declaredSchemaTypes = new Set(
+    (Array.isArray(rawSchemas) ? rawSchemas : []).map((s) => s && typeof s === "object" && "typeName" in s ? s.typeName : void 0).filter((t) => typeof t === "string")
+  );
+  const seenNames = /* @__PURE__ */ new Set();
+  const seenRanks = /* @__PURE__ */ new Map();
+  namespaces.forEach((entry, i) => {
+    if (!entry || typeof entry !== "object") return;
+    const ns = entry;
+    const path4 = ["namespaces", i];
+    if (typeof ns.namespace === "string") {
+      const err = scopeNamespaceGrammarError(ns.namespace);
+      if (err) ctx.addIssue({ code: import_zod.z.ZodIssueCode.custom, path: [...path4, "namespace"], message: err });
+      if (seenNames.has(ns.namespace)) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: [...path4, "namespace"],
+          message: `'${ns.namespace}' is declared more than once in namespaces[]`
+        });
+      }
+      seenNames.add(ns.namespace);
+    }
+    if (typeof ns.specificityRank === "number") {
+      const prior = seenRanks.get(ns.specificityRank);
+      if (prior !== void 0) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: [...path4, "specificityRank"],
+          message: `specificityRank ${ns.specificityRank} is already used by namespaces[${prior}] \u2014 every namespace's rank must be unique`
+        });
+      }
+      seenRanks.set(ns.specificityRank, i);
+    }
+    const hasRecordType = ns.membershipRecordType !== void 0;
+    const hasTargetField = ns.membershipTargetField !== void 0;
+    if (hasRecordType !== hasTargetField) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [...path4, "membershipRecordType"],
+        message: "membershipRecordType and membershipTargetField must be declared together, or neither"
+      });
+    }
+    if (typeof ns.membershipRecordType === "string" && !declaredSchemaTypes.has(ns.membershipRecordType)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [...path4, "membershipRecordType"],
+        message: `membershipRecordType '${ns.membershipRecordType}' must name a typeName this blueprint declares in schemas[] \u2014 a namespace's membership can only resolve over a record type the blueprint itself ships, never a type that merely happens to already exist in the target context.`
+      });
+    }
+    for (const [field, value2] of [
+      ["membershipRecordType", ns.membershipRecordType],
+      ["membershipTargetField", ns.membershipTargetField],
+      ["membershipLevelField", ns.membershipLevelField]
+    ]) {
+      if (typeof value2 === "string" && !MEMBERSHIP_FIELD_NAME_RE.test(value2)) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: [...path4, field],
+          message: `${field} '${value2}' is invalid \u2014 must be 1-64 characters of letters, digits, underscores, or hyphens`
+        });
+      }
+    }
+    const hasLevelField = ns.membershipLevelField !== void 0;
+    const hasLevels = Array.isArray(ns.membershipLevels) && ns.membershipLevels.length > 0;
+    if (hasLevelField !== hasLevels) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [...path4, "membershipLevelField"],
+        message: "membershipLevelField and a non-empty membershipLevels must be declared together, or neither"
+      });
+    }
+    if ((hasLevelField || hasLevels) && !hasRecordType) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: [...path4, "membershipLevelField"],
+        message: "membershipLevelField/membershipLevels require membershipRecordType + membershipTargetField too"
+      });
+    }
+    if (Array.isArray(ns.membershipLevels)) {
+      const seenLevels = /* @__PURE__ */ new Set();
+      for (const level of ns.membershipLevels) {
+        if (typeof level !== "string") continue;
+        const err = scopeNamespaceGrammarError(level);
+        if (err) {
+          ctx.addIssue({
+            code: import_zod.z.ZodIssueCode.custom,
+            path: [...path4, "membershipLevels"],
+            message: `level '${level}': ${err}`
+          });
+        } else if (seenLevels.has(level)) {
+          ctx.addIssue({
+            code: import_zod.z.ZodIssueCode.custom,
+            path: [...path4, "membershipLevels"],
+            message: `membershipLevels contains '${level}' twice`
+          });
+        }
+        seenLevels.add(level);
+      }
+    }
+  });
+}
 var SeedCommonShape = {
   /** The schema typeName this seed instantiates (should match a declared schema). */
   typeName: import_zod.z.string().min(1),
@@ -11006,7 +11483,7 @@ var BlueprintSeedRecordSchema = import_zod.z.discriminatedUnion("surface", [
   RecordSeedSchema,
   DocumentSeedSchema
 ]);
-var SELF_TOKEN_RE = /\$\{\{\s*(?:self|under)\.[^}]*?\s*\}\}/;
+var SELF_TOKEN_RE = /\$\{\{\s*(?:self|under|member)\.[^}]*?\s*\}\}/;
 function lintSelfTokenPlacement(value, ctx) {
   const walk = (node, path4, inRoleDataScope) => {
     if (typeof node === "string") {
@@ -11014,7 +11491,7 @@ function lintSelfTokenPlacement(value, ctx) {
         ctx.addIssue({
           code: import_zod.z.ZodIssueCode.custom,
           path: path4,
-          message: "'${{ self.* }}' is a runtime per-principal placeholder \u2014 it is only valid inside a roles[].dataScope value"
+          message: "'${{ self.* }}' / '${{ member.* }}' is a runtime placeholder \u2014 it is only valid inside a roles[].dataScope value, a roleAssumable[] value, or a fragments[] value"
         });
       }
       return;
@@ -11025,7 +11502,10 @@ function lintSelfTokenPlacement(value, ctx) {
     }
     if (node && typeof node === "object") {
       for (const [k, v] of Object.entries(node)) {
-        const entering = inRoleDataScope || path4.length === 3 && path4[0] === "roles" && k === "dataScope";
+        const inRoleDataScopeClause = path4.length === 3 && path4[0] === "roles" && k === "dataScope";
+        const inRoleAssumable = path4.length === 0 && k === "roleAssumable";
+        const inFragments = path4.length === 0 && k === "fragments";
+        const entering = inRoleDataScope || inRoleDataScopeClause || inRoleAssumable || inFragments;
         walk(v, [...path4, k], entering);
       }
     }
@@ -11196,6 +11676,140 @@ function lintDataScopeKeys(value, ctx) {
       }
     });
   }
+  for (const [name, fragment] of Object.entries(bp.fragments ?? {})) {
+    for (const key of Object.keys(fragment ?? {})) {
+      lintDataScopeKey(key, ["fragments", name, key], ctx);
+    }
+  }
+}
+function lintDataScopeRefs(value, ctx) {
+  const bp = value;
+  const declared = new Set(Object.keys(bp.fragments ?? {}));
+  for (const [roleId, clauses] of Object.entries(bp.roles ?? {})) {
+    clauses.forEach((clause, i) => {
+      if (clause.dataScopeRef === void 0) return;
+      if (!declared.has(clause.dataScopeRef)) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: ["roles", roleId, i, "dataScopeRef"],
+          message: `dataScopeRef '${clause.dataScopeRef}' is not declared in fragments \u2014 declared fragments: ` + (declared.size ? [...declared].join(", ") : "(none)")
+        });
+      }
+    });
+  }
+}
+var BARE_SELF_PLACEHOLDER_RE = /^\$\{\{\s*self\.[^}]*?\s*\}\}$/;
+var UNDER_SELF_PLACEHOLDER_RE = /^\$\{\{\s*under\.self\.userId\s*\}\}$/;
+var UNDER_SELF_SCOPE_PLACEHOLDER_RE = /^\$\{\{\s*under\.self\.scope\.[a-z][a-z0-9_-]{1,31}\s*\}\}$/;
+var MEMBER_SCOPE_PLACEHOLDER_RE = /^\$\{\{\s*member\.scope\.[a-z][a-z0-9_-]{1,31}(?::[a-z][a-z0-9_-]{1,31})?\s*\}\}$/;
+var ANY_PLACEHOLDER_RE = /^\$\{\{\s*any\s*\}\}$/;
+function assumableValueError(publicKey, v) {
+  if (UNDER_SELF_PLACEHOLDER_RE.test(v) || MEMBER_SCOPE_PLACEHOLDER_RE.test(v)) return null;
+  if (UNDER_SELF_SCOPE_PLACEHOLDER_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' resolves against your own current value for that namespace, which an assume can itself change \u2014 so what this grant admits would depend on what was last assumed. Use '\${{ under.self.userId }}', '\${{ member.scope.<namespace>[:level] }}', or a plain literal, all of which mean the same thing before and after an assume. ('\${{ under.self.scope.<namespace> }}' remains valid in dataScope, where it is re-derived per write)`;
+  }
+  if (ANY_PLACEHOLDER_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' is not a concrete value and cannot be authored as an assumable grant \u2014 name the specific value(s) holders of this role may become`;
+  }
+  if (BARE_SELF_PLACEHOLDER_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' is the bare self placeholder, which is tautological here \u2014 it can only ever equal whatever identity currently is, never a distinct value to become. Use '\${{ under.self.userId }}', '\${{ member.scope.<namespace>[:level] }}', or a plain literal instead`;
+  }
+  if (SELF_TOKEN_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' is not a recognized runtime placeholder \u2014 use '\${{ under.self.userId }}' or '\${{ member.scope.<namespace>[:level] }}'`;
+  }
+  if (!SCOPE_VALUE_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' is not a valid scope value \u2014 1-128 characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'`;
+  }
+  return null;
+}
+function lintAccessProfileRoleIds(value, ctx) {
+  const bp = value;
+  const roleIds = bp.accessProfile?.roleIds;
+  if (!roleIds) return;
+  const declaredRoles = new Set(Object.keys(bp.roles ?? {}));
+  const seen = /* @__PURE__ */ new Set();
+  roleIds.forEach((roleId, i) => {
+    const path4 = ["accessProfile", "roleIds", i];
+    if (!declaredRoles.has(roleId)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: path4,
+        message: `accessProfile.roleIds names '${roleId}', which is not a role this blueprint declares in roles \u2014 ` + (declaredRoles.size ? `declared roles: ${[...declaredRoles].join(", ")}` : "declared roles: (none)")
+      });
+    }
+    if (seen.has(roleId)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: path4,
+        message: `accessProfile.roleIds names '${roleId}' more than once \u2014 remove the duplicate`
+      });
+    }
+    seen.add(roleId);
+  });
+}
+function lintRoleAssumable(value, ctx) {
+  const bp = value;
+  const declaredRoles = new Set(Object.keys(bp.roles ?? {}));
+  for (const [roleId, assumable] of Object.entries(bp.roleAssumable ?? {})) {
+    if (!declaredRoles.has(roleId)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: ["roleAssumable", roleId],
+        message: `roleAssumable names '${roleId}', which is not a role this blueprint declares in roles \u2014 ` + (declaredRoles.size ? `declared roles: ${[...declaredRoles].join(", ")}` : "declared roles: (none)")
+      });
+      continue;
+    }
+    for (const [key, values] of Object.entries(assumable)) {
+      const path4 = ["roleAssumable", roleId, key];
+      if (key === "userId") {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: path4,
+          message: "assumable cannot name the principal ('userId') \u2014 the principal is never assumable via /assume, and a grant for it would save but could never be exercised"
+        });
+        continue;
+      }
+      const ns = key.startsWith("scope:") ? key.slice("scope:".length) : null;
+      const nsError = ns === null ? null : scopeNamespaceGrammarError(ns);
+      if (ns === null || nsError !== null) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: path4,
+          message: ns === null ? `'${key}' is not allowed \u2014 assumable keys must be a namespaced 'scope:<namespace>' key (the principal cannot be named)` : `assumable['${key}'] ${nsError}`
+        });
+        continue;
+      }
+      if (!Array.isArray(values)) continue;
+      values.forEach((v, i) => {
+        if (typeof v !== "string") return;
+        const err = assumableValueError(key, v);
+        if (err) ctx.addIssue({ code: import_zod.z.ZodIssueCode.custom, path: [...path4, i], message: err });
+      });
+    }
+  }
+}
+function expandDataScopeRefs(bp) {
+  if (!bp.roles) return bp;
+  const fragments = bp.fragments ?? {};
+  let changedAnyRole = false;
+  const roles = {};
+  for (const [roleId, clauses] of Object.entries(bp.roles)) {
+    let changedThisRole = false;
+    const expandedClauses = clauses.map((clause) => {
+      if (clause.dataScopeRef === void 0) return clause;
+      changedThisRole = true;
+      const { dataScopeRef, ...rest } = clause;
+      if (!(dataScopeRef in fragments)) {
+        throw new Error(
+          `expandDataScopeRefs: dataScopeRef '${dataScopeRef}' does not resolve against fragments \u2014 this should have been caught by lintDataScopeRefs before parseBlueprint reaches this function`
+        );
+      }
+      return { ...rest, dataScope: fragments[dataScopeRef] };
+    });
+    roles[roleId] = changedThisRole ? expandedClauses : clauses;
+    changedAnyRole = changedAnyRole || changedThisRole;
+  }
+  return changedAnyRole ? { ...bp, roles } : bp;
 }
 function lintSeedSurfaces(value, ctx) {
   const bp = value;
@@ -11214,9 +11828,36 @@ function lintSeedSurfaces(value, ctx) {
     }
   });
 }
+function lintIdentitySurfaces(value, ctx) {
+  const bp = value;
+  if (!Array.isArray(bp.schemas)) return;
+  bp.schemas.forEach((schema, i) => {
+    if (!schema.allowedSurfaces?.includes("user")) return;
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      path: ["schemas", i, "allowedSurfaces"],
+      message: `schema '${schema.typeName}': allowedSurfaces cannot include 'user' \u2014 a user-surfaced schema is account-global and requires a root API key, which no blueprint credential ever holds, so this would fail at apply with a 403. Model the data as a 'record' scoped to the user, or as an 'entity' schema (which a blueprint CAN provision, in its own app context).`
+    });
+  });
+}
+function lintIssuerContext(value, ctx) {
+  const bp = value;
+  if (!Array.isArray(bp.issuers)) return;
+  bp.issuers.forEach((issuer, i) => {
+    if (issuer.contextId === void 0 || issuer.contextId === bp.contextId) return;
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      path: ["issuers", i, "contextId"],
+      message: `issuer '${issuer.issuerId}' targets app context '${issuer.contextId}', but this blueprint provisions '${bp.contextId}'. An issuer must target the blueprint's own context \u2014 everything else a blueprint creates does, and an issuer that points elsewhere attaches an identity provider to an app context the blueprint never mentions. Set it to '${bp.contextId}', or move this issuer into a blueprint for '${issuer.contextId}'.`
+    });
+  });
+}
 var BLUEPRINT_FIELD_PHASES = Object.freeze({
   servicePrincipal: "bootstrap",
   issuers: "bootstrap",
+  // Registration requires the platform's provisioning:c capability, which
+  // only the bootstrap credential carries — same reasoning as issuers.
+  namespaces: "bootstrap",
   schemas: "in-context",
   accessProfile: "in-context",
   roles: "in-context",
@@ -11239,6 +11880,24 @@ var BlueprintSchema = import_zod.z.object({
   seed: import_zod.z.array(BlueprintSeedRecordSchema).optional(),
   /** Optional multi-clause roles, bound to principals via `access grant --role`. */
   roles: BlueprintRolesSchema.optional(),
+  /**
+   * Optional roleId → `POST /v1/auth/token/assume`
+   * entitlement grant, mirroring the platform's role create/update request
+   * and response shape for this field. Kept separate from `roles` rather
+   * than folded into a role entry — see {@link BlueprintRoleAssumableMapSchema}'s
+   * own doc comment for why. Every key must name a role this blueprint
+   * declares in `roles` (`lintRoleAssumable`).
+   */
+  roleAssumable: BlueprintRoleAssumableMapSchema.optional(),
+  /**
+   * Optional named `dataScope` fragments, each
+   * referenceable from a role clause via `dataScopeRef: <name>` instead of
+   * repeating the same map inline. Purely local authoring sugar: not a
+   * provisioned resource (absent from `BLUEPRINT_FIELD_PHASES`), and never
+   * survives `parseBlueprint` as a live reference — see
+   * {@link expandDataScopeRefs}.
+   */
+  fragments: BlueprintFragmentsSchema.optional(),
   /** Optional principals ensured-exist at apply; referenced via ${{ identities.* }}. */
   identities: IdentitiesDeclSchema.optional(),
   /**
@@ -11247,14 +11906,29 @@ var BlueprintSchema = import_zod.z.object({
    * service-principal creation — NOT the in-context load (see
    * {@link BlueprintIssuerSchema}).
    */
-  issuers: import_zod.z.array(BlueprintIssuerSchema).optional()
+  issuers: import_zod.z.array(BlueprintIssuerSchema).optional(),
+  /**
+   * Optional namespaces to register before anything else needs them — see
+   * {@link BlueprintNamespaceSchema}. Applied in the BOOTSTRAP-token phase,
+   * alongside app-context/service-principal creation and issuers, BEFORE
+   * schemas/seed (an `entityBacked` namespace's entities, and an
+   * `allowedSurfaces: ['entity']` schema, both need the registration to
+   * already exist). `org`/`client` need no entry — they exist already.
+   */
+  namespaces: import_zod.z.array(BlueprintNamespaceSchema).optional()
 }).strict().superRefine((bp, ctx) => {
   lintSelfTokenPlacement(bp, ctx);
   lintIdentityRefs(bp, ctx);
   lintIdentityOverrides(bp, ctx);
   lintNamespacedScopeArrays(bp, ctx);
   lintDataScopeKeys(bp, ctx);
+  lintDataScopeRefs(bp, ctx);
+  lintRoleAssumable(bp, ctx);
+  lintAccessProfileRoleIds(bp, ctx);
   lintSeedSurfaces(bp, ctx);
+  lintIdentitySurfaces(bp, ctx);
+  lintIssuerContext(bp, ctx);
+  lintNamespaces(bp, ctx);
 });
 function formatIssuePath(path4) {
   let out = "";
@@ -11290,7 +11964,7 @@ function parseBlueprint(input) {
     throw new BlueprintValidationError(`Malformed blueprint:
 ${renderIssues(issues)}`, issues);
   }
-  return result.data;
+  return expandDataScopeRefs(result.data);
 }
 function contextNameOf(blueprint) {
   return blueprint.contextName ?? `MCP \u2014 ${blueprint.name}`;
@@ -11409,9 +12083,12 @@ function deriveSuffix(contextId) {
 var WHOLE_TOKEN_RE = /^\$\{\{\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*\}\}$/;
 var TOKEN_SCAN_RE = /\$\$\{\{|\$\{\{([\s\S]*?)\}\}|\$\{\{/g;
 var INNER_REF_RE = /^([A-Za-z_]\w*)\.([A-Za-z_]\w*)$/;
-var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under"]);
+var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under", "member"]);
+var DEFERRED_BARE_TOKENS = /* @__PURE__ */ new Set(["any"]);
 var DEFERRED_NS_ALTERNATION = [...DEFERRED_NAMESPACES].join("|");
-var DEFERRED_INNER_RE = new RegExp(`^(?:${DEFERRED_NS_ALTERNATION})(?:\\.[A-Za-z_]\\w*)+$`);
+var DEFERRED_INNER_RE = new RegExp(
+  `^(?:${DEFERRED_NS_ALTERNATION})(?:\\.[A-Za-z_]\\w*)+(?::[A-Za-z_]\\w*)?$`
+);
 function resolveRef(ns, name, ctx, path4) {
   if (ns === "inputs") {
     if (!(name in ctx.declared)) {
@@ -11469,7 +12146,7 @@ function interpolate(str, ctx, path4) {
       });
     } else {
       const inner = (m[1] ?? "").trim();
-      if (DEFERRED_INNER_RE.test(inner)) {
+      if (DEFERRED_INNER_RE.test(inner) || DEFERRED_BARE_TOKENS.has(inner)) {
         out += m[0];
         last = TOKEN_SCAN_RE.lastIndex;
         continue;
@@ -11671,314 +12348,72 @@ var taskManagement = {
           renderHints: { label: "Assignee", widget: "text", order: 5, section: "Tracking" }
         },
         {
-          fieldId: "project",
-          fieldType: "string",
-          filterable: true,
-          description: "Grouping key for cross-session continuity.",
-          renderHints: { label: "Project", widget: "text", order: 6, section: "Tracking" }
-        },
-        {
-          fieldId: "dueDate",
-          fieldType: "date",
-          description: "ISO-8601. Range-queryable (see lookupFields) \u2014 list tasks due in a window.",
-          renderHints: { label: "Due date", widget: "date", order: 7, section: "Tracking" }
-        },
-        {
-          fieldId: "tags",
-          fieldType: "array",
-          filterable: true,
-          renderHints: { label: "Tags", order: 8, section: "Tracking" }
-        }
-        // externalId is the record's FIRST-CLASS identifier (the dedup/lookup key + the
-        // value a `reference` resolves against) — not a payload field; the loader sends
-        // it top-level on the RecordRequest.
-      ],
-      // Two lookup shapes, chosen deliberately because the equality-vs-range choice
-      // per field is MIGRATION-LOCKED once the schema is live (you cannot flip a
-      // field slot↔range later, even by removing and re-adding it):
-      //   • `project` — EQUALITY (a grouping key, not ordered): enumerate one
-      //     project's tasks directly, no search. Each equality lookup uses 1 of the
-      //     schema's 7 fast index slots.
-      //   • `dueDate` — RANGE: ordered `from`/`to`/`prefix` queries ("tasks due this
-      //     week", "due in 2026-06"). Range lookups use a relationship row, not a
-      //     slot, and are billed at the range rate. ISO-8601 sorts chronologically,
-      //     so the order is correct.
-      // `externalId` has a built-in first-class finder and must NOT be redeclared here.
-      lookupFields: ["project", { fieldName: "dueDate", rangeEnabled: true }]
-    }
-  ],
-  // Least-privilege profile — MUST pass the CLI scope gate.
-  // r/c/u + search + schema discovery. NOT records:d (least privilege).
-  accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"]
-    // dataScope omitted → tenant-level shared tracker. Add a `scope:org`
-    // entry for per-org isolation.
-  },
-  servicePrincipal: {
-    externalId: "task-management",
-    displayName: "Task Management"
-  },
-  seed: [
-    {
-      surface: "record",
-      typeName: "task",
-      externalId: "seed-welcome",
-      fields: {
-        title: "Welcome to your Vectros task tracker",
-        description: "Created by the bootstrap loader. Ask your agent to add tasks.",
-        status: "todo",
-        priority: "low",
-        project: "getting-started",
-        dueDate: "2026-06-30"
-      }
-    }
-  ]
-};
-var task_management_default = taskManagement;
-var codingAgentMemory = {
-  name: "coding-agent-memory",
-  version: "1.0.0",
-  description: "Persistent project memory for a coding agent \u2014 decisions, conventions, and gotchas that survive across sessions.",
-  contextId: "coding-memory",
-  contextName: "Coding Agent \u2014 Project Memory",
-  schemas: [
-    {
-      // A durable architectural/product decision: what was decided, and WHY.
-      // The rationale is the high-value, RAG-able body — "why did we do X?"
-      // is the question a cold-context agent most needs answered.
-      typeName: "decision",
-      displayName: "Decision",
-      indexMode: "HYBRID",
-      // keyword on titles + semantic on statement/rationale
-      fields: [
-        {
-          fieldId: "title",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 200 },
-          renderHints: { label: "Title", widget: "text", order: 1, displayField: true }
-        },
-        {
-          fieldId: "statement",
-          fieldType: "string",
-          searchable: true,
-          description: "What was decided, in one or two sentences.",
-          renderHints: { label: "Statement", widget: "textarea", order: 2 }
-        },
-        {
-          fieldId: "rationale",
-          fieldType: "string",
-          searchable: true,
-          description: "Why \u2014 the trade-offs and the context. The most-recalled field.",
-          renderHints: { label: "Rationale", widget: "textarea", order: 3 }
-        },
-        {
-          fieldId: "status",
-          fieldType: "enum",
-          filterable: true,
-          enumValues: ["proposed", "active", "superseded"],
-          renderHints: { label: "Status", widget: "select", order: 4 }
-        },
-        {
-          fieldId: "area",
-          fieldType: "string",
-          filterable: true,
-          description: 'Subsystem / module the decision applies to (e.g. "auth", "search").',
-          renderHints: { label: "Area", widget: "text", order: 5 }
-        },
-        {
-          fieldId: "decidedOn",
-          fieldType: "date",
-          description: 'ISO-8601 date. Range-queryable \u2014 "decisions made this quarter".',
-          renderHints: { label: "Decided on", widget: "date", order: 6 }
-        }
-        // externalId is the record's FIRST-CLASS identifier (the dedup/upsert key + the
-        // value a `reference` resolves against) — it is NOT a payload field, so it is not
-        // declared here; the loader sends it top-level on the RecordRequest.
-      ],
-      // `externalId` is a first-class identifier with its own finder (exact
-      // get/upsert) — look it up directly, never redeclare it as a schema lookup.
-      // The choice below is MIGRATION-LOCKED once the schema is live:
-      //   • `area`/`status` — EQUALITY (categorical): "list active decisions",
-      //     "all decisions in the auth area". 2 of the 7 fast index slots.
-      //   • `decidedOn` — RANGE: ordered `from`/`to`/`prefix` over the date.
-      lookupFields: ["area", "status", { fieldName: "decidedOn", rangeEnabled: true }]
-    },
-    {
-      // A coding convention the team follows — the agent reads these before it
-      // writes code so it matches the surrounding style instead of inventing one.
-      typeName: "convention",
-      displayName: "Convention",
-      indexMode: "HYBRID",
-      fields: [
-        {
-          fieldId: "name",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 200 },
-          renderHints: { label: "Name", widget: "text", order: 1, displayField: true }
-        },
-        {
-          fieldId: "rule",
-          fieldType: "string",
-          searchable: true,
-          description: "The convention itself, stated as an imperative.",
-          renderHints: { label: "Rule", widget: "textarea", order: 2 }
-        },
-        {
-          fieldId: "area",
-          fieldType: "string",
-          filterable: true,
-          renderHints: { label: "Area", widget: "text", order: 3 }
-        },
-        {
-          // Parallels `decision.status` so a convention can be RETIRED rather than
-          // deleted (the blueprint omits records:d — memory is superseded, not lost).
-          fieldId: "status",
-          fieldType: "enum",
-          filterable: true,
-          enumValues: ["active", "retired"],
-          renderHints: { label: "Status", widget: "select", order: 4 }
-        },
-        {
-          // A typed REFERENCE to the decision that established this convention — a
-          // foreign-key link between record types (the knowledge-graph edge). The
-          // platform requires both the target type AND its surface; the value is the
-          // target decision's externalId (the default `targetField`). Provenance:
-          // "why does this convention exist? → open the decision behind it." Not
-          // searchable (a foreign-key id is search noise); declared as an equality
-          // lookup below so you can also enumerate "conventions from decision X".
-          fieldId: "establishedByDecision",
-          fieldType: "reference",
-          targetTypeName: "decision",
-          targetSurface: "record",
-          targetField: "externalId",
-          cardinality: "one",
-          renderHints: { label: "Established by (decision)", order: 5 }
-        },
-        {
-          fieldId: "adoptedOn",
-          fieldType: "date",
-          description: "ISO-8601 \u2014 when this convention was adopted. Range-queryable.",
-          renderHints: { label: "Adopted on", widget: "date", order: 6 }
-        }
-        // externalId: first-class identifier, not a payload field (see `decision`).
-      ],
-      // externalId has its own first-class finder for exact get — look it up
-      // directly, not as a schema lookup. Locked equality-vs-range choices:
-      //   • `area`/`status` — EQUALITY: "active conventions for auth".
-      //   • `establishedByDecision` — EQUALITY on the reference value: enumerate
-      //     "conventions established by decision X" (a forward link query; the
-      //     platform has no reverse-reference index on this surface).
-      //   • `adoptedOn` — RANGE over the adoption date.
-      // 3 equality lookups (of 7 fast slots) + 1 range row.
-      lookupFields: ["area", "status", "establishedByDecision", { fieldName: "adoptedOn", rangeEnabled: true }]
-    },
-    {
-      // A gotcha / sharp edge: a symptom, its cause, and the fix. Saves the
-      // agent (and the human) from re-discovering the same trap.
-      typeName: "gotcha",
-      displayName: "Gotcha",
-      indexMode: "HYBRID",
-      fields: [
-        {
-          fieldId: "symptom",
-          fieldType: "string",
-          required: true,
-          searchable: true,
-          validation: { minLength: 1, maxLength: 500 },
-          renderHints: { label: "Symptom", widget: "textarea", order: 1, displayField: true }
-        },
-        {
-          fieldId: "cause",
-          fieldType: "string",
-          searchable: true,
-          renderHints: { label: "Cause", widget: "textarea", order: 2 }
-        },
-        {
-          fieldId: "fix",
-          fieldType: "string",
-          searchable: true,
-          renderHints: { label: "Fix", widget: "textarea", order: 3 }
-        },
-        {
-          fieldId: "area",
-          fieldType: "string",
-          filterable: true,
-          renderHints: { label: "Area", widget: "text", order: 4 }
-        },
-        {
-          // A gotcha can be RETIRED once the underlying trap is fixed for good —
-          // superseded, not deleted (the blueprint omits records:d).
-          fieldId: "status",
-          fieldType: "enum",
+          fieldId: "project",
+          fieldType: "string",
           filterable: true,
-          enumValues: ["active", "retired"],
-          renderHints: { label: "Status", widget: "select", order: 5 }
+          description: "Grouping key for cross-session continuity.",
+          renderHints: { label: "Project", widget: "text", order: 6, section: "Tracking" }
         },
         {
-          fieldId: "discoveredOn",
+          fieldId: "dueDate",
           fieldType: "date",
-          description: "ISO-8601 \u2014 when this gotcha was first hit. Range-queryable.",
-          renderHints: { label: "Discovered on", widget: "date", order: 6 }
+          description: "ISO-8601. Range-queryable (see lookupFields) \u2014 list tasks due in a window.",
+          renderHints: { label: "Due date", widget: "date", order: 7, section: "Tracking" }
+        },
+        {
+          fieldId: "tags",
+          fieldType: "array",
+          filterable: true,
+          renderHints: { label: "Tags", order: 8, section: "Tracking" }
         }
-        // externalId: first-class identifier, not a payload field (see `decision`).
+        // externalId is the record's FIRST-CLASS identifier (the dedup/lookup key + the
+        // value a `reference` resolves against) — not a payload field; the loader sends
+        // it top-level on the RecordRequest.
       ],
-      // externalId has its own first-class finder for exact get — look it up
-      // directly, not as a schema lookup. `area`/`status` EQUALITY ("active
-      // gotchas in search"); `discoveredOn` RANGE over the discovery date.
-      lookupFields: ["area", "status", { fieldName: "discoveredOn", rangeEnabled: true }]
+      // Two lookup shapes, chosen deliberately because the equality-vs-range choice
+      // per field is MIGRATION-LOCKED once the schema is live (you cannot flip a
+      // field slot↔range later, even by removing and re-adding it):
+      //   • `project` — EQUALITY (a grouping key, not ordered): enumerate one
+      //     project's tasks directly, no search. Each equality lookup uses 1 of the
+      //     schema's 7 fast index slots.
+      //   • `dueDate` — RANGE: ordered `from`/`to`/`prefix` queries ("tasks due this
+      //     week", "due in 2026-06"). Range lookups use a relationship row, not a
+      //     slot, and are billed at the range rate. ISO-8601 sorts chronologically,
+      //     so the order is correct.
+      // `externalId` has a built-in first-class finder and must NOT be redeclared here.
+      lookupFields: ["project", { fieldName: "dueDate", rangeEnabled: true }]
     }
   ],
   // Least-privilege profile — MUST pass the CLI scope gate.
-  // r/c/u + search + schema discovery + inference:r (grounded "why did we do X?"
-  // recall over the captured rationale). NOT records:d: memory is superseded,
-  // not deleted, so the project's decision history stays auditable.
+  // r/c/u + search + schema discovery. NOT records:d (least privilege).
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"]
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for a
+    // tenant-level shared tracker — every task visible to every holder of
+    // this credential. Add a `scope:org` entry instead for per-org isolation.
+    dataScope: {}
   },
   servicePrincipal: {
-    externalId: "coding-agent-memory",
-    displayName: "Coding Agent \u2014 Project Memory"
+    externalId: "task-management",
+    displayName: "Task Management"
   },
   seed: [
     {
-      // Seeded FIRST so the convention below resolves its reference to it — the
-      // loader creates seeds in array order, and a reference target must exist when
-      // the referencing record is written.
-      surface: "record",
-      typeName: "decision",
-      externalId: "seed-use-vectros-for-memory",
-      fields: {
-        title: "Use Vectros as the coding agent\u2019s project memory",
-        statement: "Persist decisions, conventions, and gotchas as Vectros records so they survive across agent sessions.",
-        rationale: "A coding agent loses context every cold start. A governed, searchable memory lets it recall prior decisions by meaning instead of re-asking \u2014 and the version history shows how the thinking evolved.",
-        status: "active",
-        area: "getting-started",
-        decidedOn: "2026-06-14"
-      }
-    },
-    {
-      // Demonstrates a live typed link at bootstrap: this convention references the
-      // decision above by its externalId, so "open the decision behind this rule"
-      // works the moment the blueprint is applied.
       surface: "record",
-      typeName: "convention",
-      externalId: "seed-record-the-why",
+      typeName: "task",
+      externalId: "seed-welcome",
       fields: {
-        name: "Record the why, not just the what",
-        rule: "When you record a decision or convention, always capture the rationale \u2014 the trade-offs a future session cannot re-derive from the code.",
-        area: "getting-started",
-        status: "active",
-        establishedByDecision: "seed-use-vectros-for-memory",
-        adoptedOn: "2026-06-14"
+        title: "Welcome to your Vectros task tracker",
+        description: "Created by the bootstrap loader. Ask your agent to add tasks.",
+        status: "todo",
+        priority: "low",
+        project: "getting-started",
+        dueDate: "2026-06-30"
       }
     }
   ]
 };
-var coding_agent_memory_default = codingAgentMemory;
+var task_management_default = taskManagement;
 var DATA_PLANE_ACTIONS = [
   "records:r",
   "records:c",
@@ -13105,7 +13540,11 @@ var agenticSdlc = {
   // mints for THIS blueprint's service principal (the MCP/API runtime). See
   // DATA_PLANE_ACTIONS above for the action set + rationale.
   accessProfile: {
-    allowedActions: DATA_PLANE_ACTIONS
+    allowedActions: DATA_PLANE_ACTIONS,
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach — this service key IS the runtime's own access to the whole KB,
+    // not a multi-owner resource to isolate.
+    dataScope: {}
   },
   // A reusable `editor` role for the HUMAN owner — DISTINCT from `accessProfile`
   // (which scopes only the service-principal key). `bootstrap` provisions this
@@ -13125,7 +13564,9 @@ var agenticSdlc = {
     // which includes members' private memory — the trusted-administrator tradeoff,
     // called out in the bundled guide. Scope it down if your deployment wants
     // curator access without private-memory visibility.
-    editor: [{ allowedActions: EDITOR_ACTIONS }],
+    // dataScope: {} echoes the "deliberately UNSCOPED (whole-context)" call-out
+    // above as an explicit marker, not just prose — see it for the tradeoff.
+    editor: [{ allowedActions: EDITOR_ACTIONS, dataScope: {} }],
     // A team member (or their agent) — TWO memory tiers as two UNIONed clauses
     // (a record is accessible when ANY clause grants it; within one clause every
     // dataScope dimension must match):
@@ -13145,7 +13586,9 @@ var agenticSdlc = {
     // `vectros join agentic-sdlc --role member`; verify a binding with
     // `vectros access explain --principal me --context agentic-sdlc`.
     member: [
-      { allowedActions: MEMBER_SHARED_READ_ACTIONS },
+      // dataScope: {} echoes clause 1's own "UNSCOPED, but safe" call-out above
+      // as an explicit marker, not just prose.
+      { allowedActions: MEMBER_SHARED_READ_ACTIONS, dataScope: {} },
       {
         // `inference:r` is IN this self-scoped clause (not only clause 1) so a
         // member's `rag_ask` can ground on its OWN private memory — the read
@@ -13260,7 +13703,11 @@ var secondBrain = {
   // (so the agent can `rag_ask` a grounded, cited question over your notes). No
   // records:d: notes are archived (status → 'archived'), never deleted.
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"]
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r", "inference:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach — this is a single personal-knowledge-base credential with one
+    // holder, not a multi-owner shared resource to isolate.
+    dataScope: {}
   },
   servicePrincipal: {
     externalId: "second-brain",
@@ -13392,7 +13839,11 @@ var clinicalIntake = {
   // reveal qualifier (the demo key literally cannot un-redact the PHI fields),
   // and NO inference:r (we never point a RAG capability at a PHI corpus here).
   accessProfile: {
-    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"]
+    allowedActions: ["records:r", "records:c", "records:u", "search:r", "schemas:r"],
+    // dataScope: {} (present, empty) is the deliberate marker for tenant-wide
+    // reach, unchanged from this demo's original intent — a real clinical
+    // deployment should scope this (e.g. `scope:org`) before handling real PHI.
+    dataScope: {}
   },
   servicePrincipal: {
     externalId: "clinical-intake",
@@ -13421,7 +13872,6 @@ var clinicalIntake = {
 var clinical_intake_default = clinicalIntake;
 var BUNDLED_BLUEPRINTS = [
   task_management_default,
-  coding_agent_memory_default,
   agentic_sdlc_default,
   second_brain_default,
   clinical_intake_default
@@ -13720,18 +14170,17 @@ async function mintBridgeToken(opts) {
     ttlSeconds = DEFAULT_BRIDGE_TTL_SECONDS,
     tenant = "live",
     useScopedToken = false,
+    contextId,
     fetchImpl = fetch
   } = opts;
   const base = apiBaseUrl.replace(/\/$/, "");
   const path4 = bridgeTokenPath(useScopedToken);
-  const url = `${base}${path4}?ttl=${encodeURIComponent(String(ttlSeconds))}&tenant=${encodeURIComponent(tenant)}`;
-  return fetchStToken(
-    url,
-    cognitoToken,
-    fetchImpl,
-    path4,
-    (status) => status === 404 && !useScopedToken ? ` (the dedicated ${CLI_BOOTSTRAP_TOKEN_PATH} endpoint may not be deployed yet \u2014 retry with --use-scoped-token for the fallback path)` : ""
-  );
+  let url = `${base}${path4}?ttl=${encodeURIComponent(String(ttlSeconds))}&tenant=${encodeURIComponent(tenant)}`;
+  if (contextId) url += `&context=${encodeURIComponent(contextId)}`;
+  return fetchStToken(url, cognitoToken, fetchImpl, path4, (status) => {
+    if (status !== 404 || useScopedToken || contextId) return "";
+    return ` (the dedicated ${CLI_BOOTSTRAP_TOKEN_PATH} endpoint may not be deployed yet \u2014 retry with --use-scoped-token for the fallback path)`;
+  });
 }
 async function mintContextToken(opts) {
   const {
@@ -13995,7 +14444,12 @@ async function resolveAuthContext(opts) {
   const baseUrl = envToBaseUrl(opts.env, opts.baseUrl ?? process.env.VECTROS_API_BASE_URL);
   const cognitoToken = await resolveCognitoToken(opts.env, opts.token);
   const tenant = opts.tenant ?? "live";
-  const bridge = opts.provisioning ? await mintBridgeToken({ cognitoToken, apiBaseUrl: baseUrl, tenant }) : await mintContextToken({ cognitoToken, apiBaseUrl: baseUrl, contextId: opts.context ?? "default", tenant });
+  const bridge = opts.provisioning ? await mintBridgeToken({
+    cognitoToken,
+    apiBaseUrl: baseUrl,
+    tenant,
+    ...opts.context ? { contextId: opts.context } : {}
+  }) : await mintContextToken({ cognitoToken, apiBaseUrl: baseUrl, contextId: opts.context ?? "default", tenant });
   const client = new VectrosClient({ token: bridge.token, environment: baseUrl });
   const identity = await resolveIdentity({ log: opts.log, apiKey: bridge.token, environment: baseUrl });
   return {
@@ -14114,8 +14568,32 @@ var KNOWN_CONTROL_PLANE_RESOURCES = [
   // control-plane, unlike per-namespace entity CRUD. (Cosmetic: any
   // non-data-plane resource hard-rejects whether or not it is listed here;
   // this list only sharpens the error message.)
+  //
+  // ⚠️ This bars `namespaces` as a SCOPE — no partner-authored role can ever
+  // be granted it. It does NOT bar a blueprint's own top-level `namespaces[]`
+  // FORMAT field (@vectros-ai/blueprints), which deliberately DOES write this
+  // same registry — the same "DISCRETIONARY vs UNCONDITIONAL" distinction
+  // {@link PARTIALLY_ADMITTED_OPS} draws for `entities`, applied here: the
+  // write rides `provisioning:c` (non-grantable — no partner role can ever
+  // hold it, the same bearer `keys`/`app-contexts` writes already require)
+  // and the platform confines it to the blueprint's OWN context
+  // unconditionally, never tenant-wide, so the reach is bounded to what the
+  // blueprint already provisions, never the pack's say-so alone. See
+  // `@vectros-ai/blueprints`' `namespaces[]` doc for the full design.
   "namespaces"
 ];
+var PARTIALLY_ADMITTED_OPS = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["r", "u", "d"])]
+]);
+var SELF_QUALIFIED_OPS = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["c"])]
+]);
+var UNQUALIFIABLE_WITH_ANY_TAIL = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Set(["r"])]
+]);
+var CAPABILITY_UNLOCKED_OPS = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Map([["c", "member-lifecycle"]])]
+]);
 var VALID_OPS = /* @__PURE__ */ new Set(["c", "r", "u", "d"]);
 var DATA_PLANE_SET = new Set(DATA_PLANE_ALLOWLIST);
 var CONTROL_PLANE_SET = new Set(KNOWN_CONTROL_PLANE_RESOURCES);
@@ -14132,7 +14610,60 @@ ${summary}`
     this.rejected = rejected;
   }
 };
-function evaluateScopeToken(action) {
+var GRANTED_CAPABILITIES_ALLOWLIST = ["member-lifecycle"];
+var GRANTED_CAPABILITIES_SET = new Set(GRANTED_CAPABILITIES_ALLOWLIST);
+var CAPABILITIES_HINT = GRANTED_CAPABILITIES_ALLOWLIST.join("/");
+var CapabilityGateError = class extends Error {
+  rejected;
+  constructor(rejected) {
+    const summary = rejected.map((r) => `  \u2022 ${r.action}: ${r.reason}`).join("\n");
+    super(
+      `Capability gate rejected ${rejected.length} requested capability(ies); the bootstrap loader grants (${CAPABILITIES_HINT}) only and mints nothing on reject:
+${summary}`
+    );
+    this.name = "CapabilityGateError";
+    this.rejected = rejected;
+  }
+};
+function evaluateCapabilityToken(name) {
+  const token = name.trim();
+  if (token.length === 0) {
+    return { action: name, reason: "empty capability name" };
+  }
+  if (!GRANTED_CAPABILITIES_SET.has(token)) {
+    return {
+      action: name,
+      reason: `requests capability '${token}', which the bootstrap loader does not grant (${CAPABILITIES_HINT} only). A capability outside this list must be requested deliberately in the developer portal, never via the bootstrap loader`
+    };
+  }
+  return null;
+}
+function evaluateCapabilityGate(capabilities) {
+  const accepted = [];
+  const rejected = [];
+  for (const name of capabilities ?? []) {
+    const rejection = evaluateCapabilityToken(name);
+    if (rejection) {
+      rejected.push(rejection);
+    } else {
+      accepted.push(name);
+    }
+  }
+  return { ok: rejected.length === 0, accepted, rejected };
+}
+function assertCapabilityGate(capabilities) {
+  const result = evaluateCapabilityGate(capabilities);
+  if (!result.ok) {
+    throw new CapabilityGateError(result.rejected);
+  }
+}
+function firstInvalidOp(ops) {
+  for (const ch of ops) {
+    if (!VALID_OPS.has(ch)) return ch;
+  }
+  return void 0;
+}
+function evaluateScopeToken(action, capabilities) {
   const token = action.trim();
   if (token.length === 0) {
     return { action, reason: "empty scope token" };
@@ -14153,6 +14684,51 @@ function evaluateScopeToken(action) {
     };
   }
   if (!DATA_PLANE_SET.has(resource)) {
+    const admittedOps = PARTIALLY_ADMITTED_OPS.get(resource);
+    const selfOnlyOps = SELF_QUALIFIED_OPS.get(resource);
+    if (admittedOps || selfOnlyOps) {
+      const admittedHint = [.../* @__PURE__ */ new Set([...admittedOps ?? [], ...selfOnlyOps ?? []])].sort().join("/");
+      if (ops === "*") {
+        return {
+          action,
+          reason: `requests '${resource}:*', which includes operation(s) outside the narrow allowlist (${admittedHint}) admitted for this control-plane resource. Request only the specific operations you need`
+        };
+      }
+      const invalidOp2 = firstInvalidOp(ops);
+      if (invalidOp2) {
+        return {
+          action,
+          reason: `invalid operation character '${invalidOp2}' (valid operations are c, r, u, d, or '*')`
+        };
+      }
+      const qualifier = parts.length > 2 ? parts.slice(2).join(":") : void 0;
+      const isSelfQualified = qualifier === "self";
+      const unqualifiableOps = UNQUALIFIABLE_WITH_ANY_TAIL.get(resource);
+      for (const ch of ops) {
+        if (qualifier !== void 0 && unqualifiableOps?.has(ch)) {
+          return {
+            action,
+            reason: `requests '${resource}:${ch}' alongside a qualifier ('${qualifier}'), but the platform does not resolve a qualifier for '${ch}' on '${resource}' at all \u2014 it will reject the WHOLE entry as malformed, not just ignore the qualifier. Split into separate entries (e.g. '${resource}:${ch}' + the other op(s) with their qualifier).`
+          };
+        }
+        if (admittedOps?.has(ch)) continue;
+        if (selfOnlyOps?.has(ch)) {
+          if (isSelfQualified) continue;
+          const unlockCapability = CAPABILITY_UNLOCKED_OPS.get(resource)?.get(ch);
+          if (unlockCapability && qualifier === void 0 && capabilities?.includes(unlockCapability)) continue;
+          const capabilityHintApplies = unlockCapability && !capabilities?.includes(unlockCapability);
+          return {
+            action,
+            reason: `requests control-plane scope '${resource}:${ch}' without the required ':self' qualifier. A bare or arbitrarily-qualified '${resource}:${ch}' is outside the narrow allowlist (${admittedHint}) admitted for this resource \u2014 only '${resource}:${ch}:self' is` + (capabilityHintApplies ? `, or this SAME clause also declaring 'capabilities: [${unlockCapability}]'` : unlockCapability ? ` (declaring 'capabilities: [${unlockCapability}]' does not help here \u2014 that capability only unlocks the BARE, unqualified form, never a literal-qualified one like this)` : "") + `. That operation must otherwise be done deliberately in the developer portal, never via the bootstrap loader`
+          };
+        }
+        return {
+          action,
+          reason: `requests control-plane scope '${resource}:${ch}', which is outside the narrow allowlist (${admittedHint}) admitted for this resource. That operation must be done deliberately in the developer portal, never via the bootstrap loader`
+        };
+      }
+      return null;
+    }
     if (CONTROL_PLANE_SET.has(resource)) {
       return {
         action,
@@ -14167,21 +14743,20 @@ function evaluateScopeToken(action) {
   if (ops === "*") {
     return null;
   }
-  for (const ch of ops) {
-    if (!VALID_OPS.has(ch)) {
-      return {
-        action,
-        reason: `invalid operation character '${ch}' (valid operations are c, r, u, d, or '*')`
-      };
-    }
+  const invalidOp = firstInvalidOp(ops);
+  if (invalidOp) {
+    return {
+      action,
+      reason: `invalid operation character '${invalidOp}' (valid operations are c, r, u, d, or '*')`
+    };
   }
   return null;
 }
-function evaluateScopeGate(allowedActions) {
+function evaluateScopeGate(allowedActions, capabilities) {
   const accepted = [];
   const rejected = [];
   for (const action of allowedActions) {
-    const rejection = evaluateScopeToken(action);
+    const rejection = evaluateScopeToken(action, capabilities);
     if (rejection) {
       rejected.push(rejection);
     } else {
@@ -14190,12 +14765,34 @@ function evaluateScopeGate(allowedActions) {
   }
   return { ok: rejected.length === 0, accepted, rejected };
 }
-function assertScopeGate(allowedActions) {
-  const result = evaluateScopeGate(allowedActions);
+function assertScopeGate(allowedActions, capabilities) {
+  const result = evaluateScopeGate(allowedActions, capabilities);
   if (!result.ok) {
     throw new ScopeGateError(result.rejected);
   }
 }
+function assertBlueprintGates(blueprint) {
+  if (blueprint.accessProfile.allowedActions !== void 0) {
+    assertScopeGate(blueprint.accessProfile.allowedActions, blueprint.accessProfile.capabilities);
+    assertCapabilityGate(blueprint.accessProfile.capabilities);
+  }
+  for (const clauses of Object.values(blueprint.roles ?? {})) {
+    for (const clause of clauses) {
+      assertScopeGate(clause.allowedActions, clause.capabilities);
+      assertCapabilityGate(clause.capabilities);
+    }
+  }
+}
+function effectiveAccessProfileActions(blueprint) {
+  if (blueprint.accessProfile.allowedActions !== void 0) {
+    return [...blueprint.accessProfile.allowedActions];
+  }
+  const out = [];
+  for (const roleId of blueprint.accessProfile.roleIds ?? []) {
+    for (const clause of blueprint.roles?.[roleId] ?? []) out.push(...clause.allowedActions);
+  }
+  return out;
+}
 
 // src/machine-id.ts
 var import_node_fs = require("fs");
@@ -14300,6 +14897,70 @@ async function resolveApplyTimeIdentities(blueprint, client, log) {
 function actionOf(created) {
   return created ? "created" : "reconciled";
 }
+async function registerNamespaceIdempotently(client, blueprintContextId, decl) {
+  const contextIdForRequest = decl.tenantWide ? void 0 : blueprintContextId;
+  const body = {
+    namespace: decl.namespace,
+    entityBacked: decl.entityBacked,
+    specificityRank: decl.specificityRank,
+    membershipRecordType: decl.membershipRecordType,
+    membershipTargetField: decl.membershipTargetField,
+    membershipLevelField: decl.membershipLevelField,
+    membershipLevels: decl.membershipLevels
+  };
+  try {
+    await client.registerNamespace({ contextId: contextIdForRequest, body });
+    return "created";
+  } catch (err) {
+    const info = extractServerError(err);
+    if (info.statusCode !== 400) throw err;
+    if (decl.tenantWide) throw err;
+    let existing;
+    try {
+      existing = await client.getNamespace({ namespace: decl.namespace, contextId: contextIdForRequest });
+    } catch {
+      throw err;
+    }
+    if (existing.contextId !== contextIdForRequest) throw err;
+    const mismatch = describeNamespaceMismatch(decl, existing);
+    if (mismatch) {
+      throw new Error(
+        `namespace '${decl.namespace}' is already registered with different settings than this blueprint declares (${mismatch}) \u2014 this looks like a collision with another blueprint or a manual registration, not a benign re-apply. Resolve the disagreement (or rename this blueprint's namespace) before re-applying.`
+      );
+    }
+    return "reconciled";
+  }
+}
+function describeNamespaceMismatch(decl, existing) {
+  const mismatches = [];
+  const declaredEntityBacked = decl.entityBacked ?? false;
+  const existingEntityBacked = existing.entityBacked ?? false;
+  if (declaredEntityBacked !== existingEntityBacked) {
+    mismatches.push(
+      `entityBacked: declared ${JSON.stringify(declaredEntityBacked)}, registered ${JSON.stringify(existingEntityBacked)}`
+    );
+  }
+  const fields = [
+    "specificityRank",
+    "membershipRecordType",
+    "membershipTargetField",
+    "membershipLevelField"
+  ];
+  for (const field of fields) {
+    const declared = decl[field];
+    const existingValue = existing[field];
+    if (declared === void 0 && (existingValue === void 0 || existingValue === null)) continue;
+    if (declared === existingValue) continue;
+    mismatches.push(`${field}: declared ${JSON.stringify(declared)}, registered ${JSON.stringify(existingValue)}`);
+  }
+  const declaredLevels = decl.membershipLevels;
+  const existingLevels = existing.membershipLevels;
+  const levelsDiffer = declaredLevels === void 0 ? existingLevels != null && existingLevels.length > 0 : JSON.stringify([...declaredLevels].sort()) !== JSON.stringify([...existingLevels ?? []].sort());
+  if (levelsDiffer) {
+    mismatches.push(`membershipLevels: declared ${JSON.stringify(declaredLevels)}, registered ${JSON.stringify(existingLevels)}`);
+  }
+  return mismatches.length > 0 ? mismatches.join("; ") : null;
+}
 var LostKeyError = class extends Error {
   constructor(keyName) {
     super(
@@ -14310,6 +14971,20 @@ var LostKeyError = class extends Error {
   }
   keyName;
 };
+var ExistingPrincipalNotConfirmedError = class extends Error {
+  constructor(contextId, userId, externalId) {
+    super(
+      `About to bind a NEW scoped key to a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either an intentional multi-machine setup for an integration you already own, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before a new credential is minted bound to it.`
+    );
+    this.contextId = contextId;
+    this.userId = userId;
+    this.externalId = externalId;
+    this.name = "ExistingPrincipalNotConfirmedError";
+  }
+  contextId;
+  userId;
+  externalId;
+};
 function mapEnumValues(enumValues) {
   if (!enumValues) return void 0;
   return enumValues.map((value) => ({ value }));
@@ -14384,7 +15059,8 @@ function toCapabilities(capabilities) {
 function toRoleScopeClauses(clauses) {
   return clauses.map((c) => ({
     allowed_actions: c.allowedActions,
-    data_scope: c.dataScope
+    data_scope: c.dataScope,
+    granted_capabilities: c.capabilities
   }));
 }
 var UnresolvedIdentitiesError = class extends Error {
@@ -14403,13 +15079,24 @@ function assertNoUnresolvedIdentities(blueprint) {
     );
   }
 }
-async function runLoader(client, input) {
-  const { blueprint, tenantId, machineId, rotate = false, skipSeed = false, readExistingKey, persistMintedKey, log } = input;
-  assertScopeGate(blueprint.accessProfile.allowedActions);
-  for (const clauses of Object.values(blueprint.roles ?? {})) {
-    for (const clause of clauses) assertScopeGate(clause.allowedActions);
+var TenantWideNamespacesNotAllowedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TenantWideNamespacesNotAllowedError";
   }
-  assertNoUnresolvedIdentities(blueprint);
+};
+function assertTenantWideNamespacesAllowed(blueprint, allow) {
+  if (allow) return;
+  const names = (blueprint.namespaces ?? []).filter((ns) => ns.tenantWide === true).map((ns) => ns.namespace);
+  if (names.length === 0) return;
+  throw new TenantWideNamespacesNotAllowedError(
+    `Blueprint declares namespace${names.length > 1 ? "s" : ""} ${names.map((n) => `'${n}'`).join(", ")} as tenantWide: true \u2014 visible to every context in the account, not just this blueprint's own. Refusing to request that registration without an explicit opt-in. Re-run with --allow-tenant-wide-namespaces once you've confirmed that's actually intended (only an account OWNER's credential can complete it either way \u2014 this flag doesn't change who's allowed, only whether this run tries).`
+  );
+}
+async function provisionContext(client, input) {
+  const { blueprint, allowTenantWideNamespaces = false, readExistingKey, confirmExistingPrincipal, log } = input;
+  assertBlueprintGates(blueprint);
+  assertTenantWideNamespacesAllowed(blueprint, allowTenantWideNamespaces);
   const ctxResp = await client.auth.createAppContext({ body: { contextId: blueprint.contextId, name: contextNameOf(blueprint) } });
   const contextAction = actionOf(ctxResp.created);
   log.debug({ component: "loader", contextId: blueprint.contextId, contextAction }, "app-context ensured");
@@ -14426,10 +15113,77 @@ async function runLoader(client, input) {
   if (!userId) {
     throw new Error("Service-principal create returned no user id; cannot bind AccessProfile/key.");
   }
-  log.debug({ component: "loader", externalId: blueprint.servicePrincipal.externalId, userId }, "service principal ensured");
+  const userAction = actionOf(user.created);
+  log.debug(
+    { component: "loader", externalId: blueprint.servicePrincipal.externalId, userId, userAction },
+    "service principal ensured"
+  );
+  const localKeyForContext = await readExistingKey(blueprint.contextId);
+  const storedPrincipalId = localKeyForContext?.principalId;
+  const localKeyNamesThisPrincipal = storedPrincipalId === `usr_${userId}` || storedPrincipalId === userId;
+  if (userAction === "reconciled" && !localKeyNamesThisPrincipal) {
+    const proceed = confirmExistingPrincipal ? await confirmExistingPrincipal({
+      contextId: blueprint.contextId,
+      userId,
+      externalId: blueprint.servicePrincipal.externalId
+    }) : true;
+    if (!proceed) {
+      throw new ExistingPrincipalNotConfirmedError(blueprint.contextId, userId, blueprint.servicePrincipal.externalId);
+    }
+    log.debug(
+      { component: "loader", contextId: blueprint.contextId, userId },
+      "existing-principal collision confirmed (or unwired) \u2014 proceeding with any further write to this principal"
+    );
+  }
+  const needsContextPinnedBootstrap = (blueprint.namespaces ?? []).length > 0;
+  const ctxBootstrapClient = needsContextPinnedBootstrap ? input.remintBootstrapForContext ? await input.remintBootstrapForContext(blueprint.contextId) : client : void 0;
+  if (ctxBootstrapClient && input.remintBootstrapForContext) {
+    log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted context-pinned bootstrap client (namespaces)");
+  }
+  const namespaceActions = [];
+  for (const ns of blueprint.namespaces ?? []) {
+    const action = await registerNamespaceIdempotently(ctxBootstrapClient.identity, blueprint.contextId, ns);
+    namespaceActions.push({ namespace: ns.namespace, action });
+    log.debug({ component: "loader", namespace: ns.namespace, contextId: blueprint.contextId, action }, "namespace ensured");
+  }
+  return { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions, ctxBootstrapClient };
+}
+async function runLoader(client, input) {
+  const {
+    blueprint,
+    tenantId,
+    machineId,
+    rotate = false,
+    skipSeed = false,
+    allowTenantWideNamespaces = false,
+    readExistingKey,
+    persistMintedKey,
+    confirmExistingPrincipal,
+    log
+  } = input;
+  assertNoUnresolvedIdentities(blueprint);
+  const provisioned = input.provisioned ?? await provisionContext(client, {
+    blueprint,
+    allowTenantWideNamespaces,
+    remintBootstrapForContext: input.remintBootstrapForContext,
+    readExistingKey,
+    confirmExistingPrincipal,
+    log
+  });
+  const { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions } = provisioned;
+  assertBlueprintGates(blueprint);
+  const needsContextPinnedBootstrapForIssuers = (blueprint.issuers ?? []).length > 0;
+  const ctxBootstrapClient = provisioned.ctxBootstrapClient ?? (needsContextPinnedBootstrapForIssuers ? input.remintBootstrapForContext ? await input.remintBootstrapForContext(blueprint.contextId) : client : void 0);
+  if (ctxBootstrapClient && !provisioned.ctxBootstrapClient && input.remintBootstrapForContext) {
+    log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted context-pinned bootstrap client (issuers)");
+  }
   const issuerActions = [];
   for (const issuer of blueprint.issuers ?? []) {
-    const issuerResp = await client.auth.registerIssuer({
+    const selfSignupPolicies = issuer.selfSignupPolicies?.map((p) => ({
+      signup_type: p.signupType,
+      role_id: p.roleId
+    }));
+    const issuerResp = await ctxBootstrapClient.auth.registerIssuer({
       issuerId: issuer.issuerId,
       issuer: issuer.issuer,
       jwksUri: issuer.jwksUri,
@@ -14437,18 +15191,26 @@ async function runLoader(client, input) {
       contextId: issuer.contextId,
       subClaim: issuer.subClaim,
       emailClaim: issuer.emailClaim,
-      selfSignupPolicies: issuer.selfSignupPolicies?.map((p) => ({
-        signup_type: p.signupType,
-        role_id: p.roleId
-      }))
+      userinfoUri: issuer.userinfoUri,
+      selfSignupPolicies
     });
     const action = actionOf(issuerResp.created);
     issuerActions.push({ issuerId: issuer.issuerId, action });
     if (action === "reconciled") {
-      log.warn(
-        { component: "loader", issuerId: issuer.issuerId },
-        "issuer already registered \u2014 the platform has no update-issuer endpoint, so any edited fields (jwksUri, audience, subClaim, emailClaim, selfSignupPolicies) on this apply were NOT applied to the existing registration"
-      );
+      await ctxBootstrapClient.auth.updateIssuer({
+        issuerId: issuer.issuerId,
+        // Trust-anchor/routing-pin fields — echoed back, never actually
+        // changed here (the platform rejects a differing value).
+        issuer: issuer.issuer,
+        jwksUri: issuer.jwksUri,
+        audience: issuer.audience,
+        contextId: issuer.contextId,
+        subClaim: issuer.subClaim,
+        emailClaim: issuer.emailClaim,
+        userinfoUri: issuer.userinfoUri,
+        selfSignupPolicies
+      });
+      log.debug({ component: "loader", issuerId: issuer.issuerId }, "issuer already registered \u2014 reconciled safe fields to the declared values");
     } else {
       log.debug({ component: "loader", issuerId: issuer.issuerId, action }, "issuer registered");
     }
@@ -14488,10 +15250,35 @@ async function runLoader(client, input) {
     schemaActions.push({ typeName: s.typeName, action: actionOf(resp.created) });
     log.debug({ component: "loader", typeName: s.typeName, schemaId: resp.id, action: actionOf(resp.created) }, "schema ensured (upsert)");
   }
-  const profileBody = {
+  const roleIds = [];
+  const roleActions = [];
+  for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
+    const roleResp = await ctxClient.auth.createRole({
+      contextId: blueprint.contextId,
+      upsert: true,
+      body: {
+        roleId,
+        // Blueprint roles carry no display name → default it to the roleId.
+        name: roleId,
+        scopes: toRoleScopeClauses(clauses),
+        assumable: blueprint.roleAssumable?.[roleId]
+      }
+    });
+    roleIds.push(roleId);
+    roleActions.push({ roleId, action: actionOf(roleResp.created) });
+    log.debug({ component: "loader", roleId, clauses: clauses.length, action: actionOf(roleResp.created) }, "role ensured (upsert)");
+  }
+  const profileBody = blueprint.accessProfile.roleIds ? {
+    principalId: `usr_${userId}`,
+    roleIds: blueprint.accessProfile.roleIds,
+    identityOverrides: blueprint.accessProfile.identityOverrides
+  } : {
     principalId: `usr_${userId}`,
     scopes: [
       {
+        // Non-null: this is the `else` branch of the roleIds XOR above —
+        // `@vectros-ai/blueprints`' BlueprintAccessProfileSchema guarantees
+        // allowedActions is set whenever roleIds is not.
         allowed_actions: blueprint.accessProfile.allowedActions,
         // Pass dataScope straight through to the wire. The blueprint type is
         // Record<string, (string|null)[]> — a `null` element is the NULL
@@ -14499,7 +15286,10 @@ async function runLoader(client, input) {
         // literal JSON null, which is exactly what the platform's scope
         // matcher tests via `allowedValues.contains(null)`. The cast bridges
         // to the SDK's loosely-typed Record<string, Record<string,unknown>>.
-        data_scope: blueprint.accessProfile.dataScope
+        data_scope: blueprint.accessProfile.dataScope,
+        // Already gate-validated (assertBlueprintGates, above this function's
+        // call site) before this body is ever built.
+        granted_capabilities: blueprint.accessProfile.capabilities
       }
     ],
     // Optional identity overrides — scope values the service key STAMPS onto
@@ -14522,22 +15312,6 @@ async function runLoader(client, input) {
     body: profileBody
   });
   log.debug({ component: "loader", principalId: `usr_${userId}`, accessProfileId: profile.id, profileAction }, "access profile ensured + reconciled to declared scopes");
-  const roleIds = [];
-  const roleActions = [];
-  for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
-    const roleResp = await ctxClient.auth.createRole({
-      contextId: blueprint.contextId,
-      body: {
-        roleId,
-        // Blueprint roles carry no display name → default it to the roleId.
-        name: roleId,
-        scopes: toRoleScopeClauses(clauses)
-      }
-    });
-    roleIds.push(roleId);
-    roleActions.push({ roleId, action: actionOf(roleResp.created) });
-    log.debug({ component: "loader", roleId, clauses: clauses.length, action: actionOf(roleResp.created) }, "role ensured");
-  }
   const keyName = keyNameFor(blueprint.name, machineId);
   let keyAction = "created";
   let revokedKeyId;
@@ -14557,7 +15331,7 @@ async function runLoader(client, input) {
     keyId = keyResp.keyId ?? "";
     rawKey = keyResp.rawKey;
     if (keyId) {
-      await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: userId, revokedKeyId });
+      await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: `usr_${userId}`, revokedKeyId });
     }
     if (keyAction !== "rotated") keyAction = "created";
   } else {
@@ -14631,10 +15405,12 @@ async function runLoader(client, input) {
     keyName,
     keyAction,
     contextAction,
+    userAction,
     profileAction,
     schemaActions,
     roleActions,
     issuerActions,
+    namespaceActions,
     rawKey,
     keyId,
     revokedKeyId,
@@ -14646,6 +15422,11 @@ async function runLoader(client, input) {
     seedIndexFailures
   };
 }
+function renderPlanDataScope(ds) {
+  const entries = Object.entries(ds ?? {});
+  if (entries.length === 0) return "(none \u2014 unconstrained)";
+  return entries.map(([dim, values]) => `${dim}=[${values.map((v) => v === null ? "null" : v).join(", ")}]`).join(", ");
+}
 function buildPlan(blueprint, opts = {}) {
   const steps = [];
   steps.push({ kind: "context", summary: `context '${blueprint.contextId}' (${contextNameOf(blueprint)})` });
@@ -14653,6 +15434,15 @@ function buildPlan(blueprint, opts = {}) {
     kind: "principal",
     summary: `principal '${blueprint.servicePrincipal.externalId}' (SERVICE)`
   });
+  for (const ns of blueprint.namespaces ?? []) {
+    const ownerNote = ns.tenantWide ? "TENANT-WIDE \u2014 visible to every context" : `owned by '${blueprint.contextId}'`;
+    const entityNote = ns.entityBacked ? ", entity-backed" : "";
+    const membershipNote = ns.membershipRecordType ? `, membership: ${ns.membershipRecordType}.${ns.membershipTargetField}` + (ns.membershipLevelField ? ` (levels: ${ns.membershipLevels?.join("/")})` : "") : "";
+    steps.push({
+      kind: "namespace",
+      summary: `namespace '${ns.namespace}' (${ownerNote}${entityNote}${membershipNote}) [${BLUEPRINT_FIELD_PHASES.namespaces}-token phase]`
+    });
+  }
   for (const iss of blueprint.issuers ?? []) {
     const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: ${iss.selfSignupPolicies.length} polic${iss.selfSignupPolicies.length === 1 ? "y" : "ies"}` : "";
     steps.push({
@@ -14673,17 +15463,40 @@ function buildPlan(blueprint, opts = {}) {
       summary: `schema '${s.typeName}' (${s.fields.length} field${s.fields.length === 1 ? "" : "s"}, ${indexNote})${lookupNote}${surfaceNote}${sensitiveNote}`
     });
   }
-  const actions = blueprint.accessProfile.allowedActions;
-  const scopeNote = blueprint.accessProfile.dataScope && Object.keys(blueprint.accessProfile.dataScope).length ? ` dataScope: ${Object.keys(blueprint.accessProfile.dataScope).join(", ")}` : "";
-  steps.push({
-    kind: "profile",
-    summary: `profile scopes [${actions.join(", ")}] (data-plane \u2713)${scopeNote}`
-  });
   for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
     const actionSet = [...new Set(clauses.flatMap((c) => c.allowedActions))];
+    const capSet = [...new Set(clauses.flatMap((c) => c.capabilities ?? []))];
+    const roleCapabilityNote = capSet.length ? `, capabilities [${capSet.join(", ")}]` : "";
+    const clauseLines = clauses.map((c, i) => {
+      const capNote = c.capabilities?.length ? `, capabilities [${c.capabilities.join(", ")}]` : "";
+      return `      clause ${i + 1}: actions [${c.allowedActions.join(", ")}], dataScope: ${renderPlanDataScope(c.dataScope)}${capNote}`;
+    });
+    const assumable = blueprint.roleAssumable?.[roleId];
+    const assumableLine = assumable ? `
+      assumable: ${renderPlanDataScope(assumable)}` : "";
     steps.push({
       kind: "role",
-      summary: `role '${roleId}' (${clauses.length} clause${clauses.length === 1 ? "" : "s"}, actions [${actionSet.join(", ")}])`
+      summary: `role '${roleId}' (${clauses.length} clause${clauses.length === 1 ? "" : "s"}, actions [${actionSet.join(", ")}]${roleCapabilityNote})
+` + clauseLines.join("\n") + assumableLine
+    });
+  }
+  const roleIdsNote = blueprint.accessProfile.roleIds;
+  if (roleIdsNote) {
+    steps.push({
+      kind: "profile",
+      summary: `profile via role(s) [${roleIdsNote.join(", ")}] (composed \u2014 each role's own clauses, concatenated in order)`
+    });
+  } else {
+    const actions = blueprint.accessProfile.allowedActions ?? [];
+    const scopeNote = blueprint.accessProfile.dataScope && Object.keys(blueprint.accessProfile.dataScope).length ? ` dataScope: ${Object.keys(blueprint.accessProfile.dataScope).join(", ")}` : "";
+    const capabilityNote = blueprint.accessProfile.capabilities?.length ? ` capabilities: [${blueprint.accessProfile.capabilities.join(", ")}]` : "";
+    const allDataPlane = !actions.some(
+      (a) => KNOWN_CONTROL_PLANE_RESOURCES.includes(a.split(":", 1)[0])
+    );
+    const planeNote = allDataPlane ? " (data-plane \u2713)" : " (includes a control-plane exception)";
+    steps.push({
+      kind: "profile",
+      summary: `profile scopes [${actions.join(", ")}]${planeNote}${scopeNote}${capabilityNote}`
     });
   }
   steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
@@ -14706,10 +15519,25 @@ function renderPlan(blueprint, steps) {
   ];
   if (steps.some((s) => s.kind === "issuer")) {
     legendLines.push(
-      `  Exception: issuers cannot be updated once registered \u2014 an existing`,
-      `  issuer is left unchanged, not reconciled to match.`
+      `  Exception: an issuer's trust-anchor fields (issuer, jwksUri, audience,`,
+      `  contextId) are immutable once registered \u2014 only subClaim/emailClaim/`,
+      `  userinfoUri/selfSignupPolicies actually reconcile on a re-apply (status is not`,
+      `  authorable in a blueprint at all).`
     );
   }
+  if (steps.some((s) => s.kind === "namespace")) {
+    legendLines.push(
+      `  Exception: namespace registration is not idempotent \u2014 a re-apply matching`,
+      `  an existing registration converges silently, but one that disagrees FAILS`,
+      `  the apply rather than reconciling it.`
+    );
+    if (steps.some((s) => s.kind === "namespace" && /TENANT-WIDE/.test(s.summary))) {
+      legendLines.push(
+        `  Stricter still for a TENANT-WIDE namespace: it never converges, even on an`,
+        `  exact match \u2014 any existing registration of that name fails the apply.`
+      );
+    }
+  }
   const legend = legendLines.join("\n");
   const lines = steps.map((s) => `    + ${s.summary}`);
   return [header, legend, "", ...lines].join("\n");
@@ -14958,6 +15786,15 @@ var OsKeychainSecretStore = class {
    * against the real Windows store on every MR — the dev-machine probe is a point
    * measurement, not a regression gate. (Tracked internally; this file ships to
    * public npm, so no tracker number here.)
+   *
+   * ⚠️ THIS METHOD'S FAIL-CLOSED GUARANTEE IS AN UPSTREAM BEHAVIOURAL CONTRACT, NOT
+   * SOMETHING THIS CODE ENFORCES. `@napi-rs/keyring` is pinned to an EXACT version
+   * in `package.json` for exactly this reason: if a future release returned `[]`
+   * from `findCredentials()` on a locked store instead of throwing, the `catch`
+   * block above would never run — `!.some(...)` on an empty array reads as "gone",
+   * `deleteSecret` returns `true`, and `remove`/`prune` drop the index row of a
+   * still-live credential. A version bump of this dependency is a security review
+   * of the paragraph above against the new release, not a routine dependency bump.
    */
   async deleteSecret(ref) {
     try {
@@ -15891,6 +16728,26 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
     const entry = await this.getActive();
     return entry ? this.readSecret(entry) : void 0;
   }
+  /**
+   * The ACTIVE entry's tenant (test/live), or undefined if there is no active
+   * entry or its tenant cannot be determined — WITHOUT migrating its secret.
+   *
+   * Deliberately NOT built on {@link resolveActiveSecret}/{@link readSecret}:
+   * both migrate the secret to this machine's preferred store as a side effect
+   * of reading it, and a caller that only wants to CLASSIFY the active identity
+   * (e.g. "is it safe to activate a different one over it?") must not silently
+   * relocate — and take the cross-process index lock for — a credential it has
+   * no other reason to touch. Same non-migrating shape {@link assess} already
+   * uses per entry (`store.getSecret` directly, never `readSecret`).
+   */
+  async activeTenant() {
+    const entry = await this.getActive();
+    if (!entry) return void 0;
+    const store = this.storeFor(entry);
+    if (!store) return void 0;
+    const secret = await store.getSecret(entry.secretRef);
+    return secret !== void 0 ? keyTenant(secret) : void 0;
+  }
   /**
    * Read one entry's secret, moving it to this machine's preferred store if it is
    * somewhere else.
@@ -16017,26 +16874,31 @@ var readline = __toESM(require("readline/promises"));
 async function runKeyringList(opts, deps = {}) {
   try {
     const keyring = deps.keyring ?? await Keyring.open();
-    const entries = await keyring.list();
-    const active = await keyring.activeAlias();
     if (opts.json) {
+      const entries = await keyring.list();
+      const active = await keyring.activeAlias();
       process.stdout.write(`${formatJson({ active, entries })}
 `);
       return 0;
     }
-    if (entries.length === 0) {
+    const { health } = await assessEntries(keyring);
+    if (health.length === 0) {
       process.stdout.write("\n  (no keyring entries yet \u2014 run `vectros join <context>` to add one)\n");
       return 0;
     }
     process.stdout.write(
-      "\n" + formatTable(entries, [
-        { header: "", get: (e) => e.alias === active ? "*" : "" },
-        { header: "alias", get: (e) => e.alias },
-        { header: "context", get: (e) => e.context },
-        { header: "principal", get: (e) => e.principalId },
-        { header: "role", get: (e) => e.role },
-        { header: "env", get: (e) => e.env },
-        { header: "key id", get: (e) => e.keyId }
+      "\n" + formatTable(health, [
+        { header: "", get: (h) => h.active ? "*" : "" },
+        { header: "alias", get: (h) => h.entry.alias },
+        { header: "context", get: (h) => h.entry.context },
+        { header: "principal", get: (h) => h.entry.principalId },
+        { header: "role", get: (h) => h.entry.role },
+        // `tenant` (test/live) replaces the old `env` (staging/production) column
+        // here: env is an internal-team concern an external developer's CLI never
+        // sees, while tenant is the distinction every user routinely holds two
+        // credentials side by side over.
+        { header: "tenant", get: (h) => tenantCell(h, { upper: true }) },
+        { header: "key id", get: (h) => h.entry.keyId }
       ]) + "\n"
     );
     return 0;
@@ -16218,6 +17080,10 @@ async function assessEntries(keyring) {
     }))
   };
 }
+function tenantCell(h, opts) {
+  if (h.status !== "ok") return void 0;
+  return h.tenant ?? (opts.upper ? "UNKNOWN" : "unknown");
+}
 function describeEntry(h) {
   return `${h.entry.alias} (${h.entry.context}, ${h.entry.keyId})`;
 }
@@ -16362,9 +17228,7 @@ async function runKeyringDoctor(opts, deps = {}) {
           // `unknown` can escalate; one that sees a confident wrong answer cannot.
           store: storeKindOf(h.entry) ?? "unknown",
           secret: h.status,
-          // `unknown` rather than absent: a consumer must be able to tell "not a
-          // live key" from "we could not read the shape of this one".
-          tenant: h.status === "ok" ? h.tenant ?? "unknown" : void 0
+          tenant: tenantCell(h, { upper: false })
         })),
         liveKeys: liveKeys.map((h) => h.entry.alias),
         findings
@@ -16379,7 +17243,7 @@ async function runKeyringDoctor(opts, deps = {}) {
         { header: "", get: (h) => h.active ? "*" : "" },
         { header: "alias", get: (h) => h.entry.alias },
         { header: "context", get: (h) => h.entry.context },
-        { header: "tenant", get: (h) => h.status === "ok" ? h.tenant ?? "UNKNOWN" : void 0 },
+        { header: "tenant", get: (h) => tenantCell(h, { upper: true }) },
         { header: "key id", get: (h) => h.entry.keyId },
         { header: "secret", get: (h) => h.status === "ok" ? "ok" : h.status.toUpperCase() }
       ]) + "\n"
@@ -16573,6 +17437,47 @@ function keyringAliasFor(alias, tenant) {
   }
   return tenant === "test" ? `${alias}.test` : alias;
 }
+function resolveActivateDecision(opts) {
+  if (opts.explicitActivate !== void 0) return opts.explicitActivate;
+  if (opts.tenant === "live") return true;
+  return opts.currentActiveTenant !== "live";
+}
+async function determineActivateDecision(keyring, opts) {
+  if (opts.explicitActivate !== void 0 || opts.tenant === "live") {
+    return resolveActivateDecision(opts);
+  }
+  let currentActiveTenant;
+  try {
+    if (opts.hint && opts.hint.alias === await keyring.activeAlias()) {
+      currentActiveTenant = keyTenant(opts.hint.secret);
+    } else {
+      currentActiveTenant = await keyring.activeTenant();
+    }
+  } catch {
+  }
+  return resolveActivateDecision({ ...opts, currentActiveTenant });
+}
+function tenantActivateMessage(opts) {
+  if (opts.willActivate) {
+    if (opts.tenant !== "test") return "";
+    return `
+  \u26A0 '${opts.alias}' is now your ACTIVE identity \u2014 a TEST tenant credential. Anything
+    resolving a key with no explicit --alias (including the MCP server) follows it.
+`;
+  }
+  if (opts.explicitlyDeclined) {
+    return `
+  \u26A0 Stored '${opts.alias}' (${opts.tenant} tenant) without activating it \u2014 you passed --no-activate.
+    Run \`vectros switch ${opts.alias}\` when you're ready to use it.
+`;
+  }
+  return `
+  \u26A0 Stored '${opts.alias}' (test tenant) WITHOUT activating it \u2014 your currently-active
+    identity is a LIVE credential, and switching it out from under you silently is
+    exactly the mistake this check exists to prevent. Run \`vectros switch ${opts.alias}\`
+    to use the test key, or re-run with --activate to do so automatically.
+`;
+}
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -16669,10 +17574,7 @@ async function storeMintedKey(keyring, binding, secret, opts = {}) {
 // src/cli-bootstrap.ts
 function validateBlueprint(input) {
   const blueprint = parseBlueprint(input);
-  assertScopeGate(blueprint.accessProfile.allowedActions);
-  for (const clauses of Object.values(blueprint.roles ?? {})) {
-    for (const clause of clauses) assertScopeGate(clause.allowedActions);
-  }
+  assertBlueprintGates(blueprint);
   return blueprint;
 }
 var BLANK_SLATE = {
@@ -16694,9 +17596,11 @@ function parseBootstrapArgs(argv) {
     yes: false,
     noMerge: false,
     rotate: false,
+    confirmExistingPrincipal: false,
     useScopedToken: false,
     blankSlate: false,
     noSeed: false,
+    allowTenantWideNamespaces: false,
     client: "desktop",
     tenant: "live",
     help: false
@@ -16745,6 +17649,9 @@ function parseBootstrapArgs(argv) {
       case "--rotate":
         args.rotate = true;
         break;
+      case "--confirm-existing-principal":
+        args.confirmExistingPrincipal = true;
+        break;
       case "--use-scoped-token":
         args.useScopedToken = true;
         break;
@@ -16755,6 +17662,9 @@ function parseBootstrapArgs(argv) {
       case "--no-seed":
         args.noSeed = true;
         break;
+      case "--allow-tenant-wide-namespaces":
+        args.allowTenantWideNamespaces = true;
+        break;
       case "--tenant": {
         const v = argv[++i];
         if (v !== "test" && v !== "live") {
@@ -16766,6 +17676,12 @@ function parseBootstrapArgs(argv) {
       case "--test":
         args.tenant = "test";
         break;
+      case "--activate":
+        args.activate = true;
+        break;
+      case "--no-activate":
+        args.activate = false;
+        break;
       case "--help":
       case "-h":
         args.help = true;
@@ -16783,6 +17699,26 @@ function seedDeclined(answer) {
   const a = answer.trim().toLowerCase();
   return a === "n" || a === "no";
 }
+function existingPrincipalConfirmed(answer) {
+  const a = answer.trim().toLowerCase();
+  return a === "y" || a === "yes";
+}
+function buildConfirmExistingPrincipal(args, prompt, isTty) {
+  return async (details) => {
+    if (!args.yes && isTty) {
+      const ans = await prompt(
+        `
+  \u26A0 '${details.externalId}' already exists in your tenant (context '${details.contextId}') \u2014 this key will bind to that EXISTING identity, not a new one.
+  Expected if you're re-applying a blueprint from a new machine, or setting up a second
+  credential for an integration you already own. If you don't recognize this identity,
+  do NOT proceed \u2014 this may be a name collision with something you don't control.
+  Proceed and bind to the existing identity? [y/N]: `
+      );
+      return existingPrincipalConfirmed(ans);
+    }
+    return args.confirmExistingPrincipal;
+  };
+}
 function seedSummaryLine(opts) {
   if (opts.noSeed) {
     return opts.declinedInteractively ? "  \u2714 Seeded 0 record(s) \u2014 skipped (you declined sample data)\n" : "  \u2714 Seeded 0 record(s) \u2014 skipped (--no-seed)\n";
@@ -16810,25 +17746,30 @@ function reconcileTally(items, noun) {
   if (reconciled) seg.push(`${reconciled} reconciled`);
   return `${items.length} ${noun}${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
 }
-function issuerTally(items) {
+function namespaceTally(items) {
   if (items.length === 0) return null;
   const created = items.filter((i) => i.action === "created").length;
-  const unchanged = items.length - created;
+  const matched = items.length - created;
   const seg = [];
   if (created) seg.push(`${created} created`);
-  if (unchanged) seg.push(`${unchanged} already registered \u2014 unchanged (issuers cannot be updated once registered)`);
-  return `${items.length} issuer${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
+  if (matched) seg.push(`${matched} already registered \u2014 confirmed matching`);
+  return `${items.length} namespace${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
 }
 function applyOutcomeSummary(result) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
     reconcileTally(result.roleActions, "role"),
-    issuerTally(result.issuerActions),
+    // #1023 — the platform's PUT /v1/auth/issuers/{issuerId} makes an issuer's
+    // 'reconciled' mean the same "updated to match" as every other kind here.
+    reconcileTally(result.issuerActions, "issuer"),
+    namespaceTally(result.namespaceActions),
     `profile ${result.profileAction}`
   ].filter((p) => p !== null);
   const detail = parts.length ? ` \u2014 ${parts.join("; ")}` : "";
+  const principalNote = result.userAction === "reconciled" ? `  \u26A0 service principal already existed in this tenant before this run (not newly created)
+` : "";
   return `  \u2714 context '${result.contextId}' ${result.contextAction}${detail}
-`;
+${principalNote}`;
 }
 var BOOTSTRAP_HELP = `vectros bootstrap \u2014 provision a least-privilege MCP credential.
 
@@ -16836,7 +17777,7 @@ Usage:
   vectros bootstrap [--blueprint <name> | --blank] [--no-seed]
                     [--set name=value ...] [--values <file>]
                     [--tenant test|live | --test] [--client desktop|code]
-                    [--yes] [--no-merge] [--rotate]
+                    [--yes] [--no-merge] [--rotate] [--confirm-existing-principal]
                     [--token <t> | env VECTROS_BOOTSTRAP_TOKEN]
                     [--base-url <url>] [--use-scoped-token]
 
@@ -16853,12 +17794,24 @@ Options:
                            sample seed records \u2014 the right choice for a production context
                            (a blueprint's seeds are illustrative, not real data). Unlike
                            --blank, the schemas are still created.
+  --allow-tenant-wide-namespaces
+                           Required to apply a blueprint that declares a namespace with
+                           tenantWide: true \u2014 visible to every context in the account, not
+                           just this one. Without it, bootstrap refuses before provisioning
+                           anything, naming the namespace(s). Only an account OWNER's
+                           credential can actually complete the registration either way \u2014
+                           this flag doesn't change who's allowed, only whether this run
+                           tries. Never needed for a blueprint with no tenantWide namespace.
   --tenant test|live       Which tenant the minted key scopes to (default: live).
                            'test' provisions into your isolated test tenant \u2014 a
                            dry-run before pointing real data at the same blueprint.
                            The tenant rides the key (ssk_test_* vs ssk_live_*), so
                            the MCP/client config is otherwise identical.
   --test                   Shorthand for --tenant test.
+  --activate               Force the freshly-stored key to become your active identity, even
+                           if that would switch away from a currently-active LIVE credential
+                           (the one case --tenant test does NOT do this automatically).
+  --no-activate            Store the key without activating it, regardless of tenant.
   --base-url <url>         Override the API base URL (beats VECTROS_API_BASE_URL).
   --client <desktop|code>  MCP host to configure (default: desktop). 'desktop' merges
                            claude_desktop_config.json (also works for Cursor/Cline);
@@ -16873,6 +17826,13 @@ Options:
                            print the config snippet instead of merging it into your client's
                            config file. Not a dry run; see 'blueprint plan' for that.
   --rotate                 Revoke + re-mint THIS machine's key.
+  --confirm-existing-principal
+                           Required (with --yes, or with no TTY) to mint a NEW key bound to a
+                           service principal that already existed in your tenant before this run
+                           \u2014 e.g. a deliberate second machine for an integration you already own.
+                           Refused by default so an unexpected collision halts a CI run loudly
+                           instead of silently minting a credential bound to the wrong identity.
+                           Never needed for --rotate or an ordinary same-machine re-apply.
   --use-scoped-token       Legacy fallback.
                            NOTE: it mints a token WITHOUT the provisioning
                            capability, so it cannot create a blueprint's
@@ -16960,6 +17920,22 @@ function buildRemintForContext(opts) {
     });
   };
 }
+function buildRemintBootstrapForContext(opts) {
+  const mintBridge = opts.mintBridge ?? mintBridgeToken;
+  return async (contextId) => {
+    const ctxToken = await mintBridge({
+      cognitoToken: opts.cognitoToken,
+      apiBaseUrl: opts.apiBaseUrl,
+      contextId,
+      tenant: opts.tenant,
+      useScopedToken: opts.useScopedToken
+    });
+    return new VectrosClient({
+      token: ctxToken.token,
+      environment: opts.apiBaseUrl
+    });
+  };
+}
 async function runBootstrapCli(argv, deps = {}) {
   const log = deps.log ?? createLogger2();
   let args;
@@ -16993,17 +17969,36 @@ ${BOOTSTRAP_HELP}
   \u2716 Scope gate refused blueprint '${blueprint.name}':
 `);
         for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+        process.stderr.write("  Minting nothing.\n");
+        return 2;
+      }
+      if (err instanceof CapabilityGateError) {
+        process.stderr.write(`
+  \u2716 Capability gate refused blueprint '${blueprint.name}':
+`);
+        for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
         process.stderr.write("  Minting nothing.\n");
         return 2;
       }
       throw err;
     }
-    const gate = evaluateScopeGate(blueprint.accessProfile.allowedActions);
-    process.stdout.write(`
+    const roleNote = blueprint.accessProfile.roleIds ? ` via role(s) [${blueprint.accessProfile.roleIds.join(", ")}]` : "";
+    const acceptedActions = effectiveAccessProfileActions(blueprint);
+    const allDataPlane = !acceptedActions.some(
+      (a) => KNOWN_CONTROL_PLANE_RESOURCES.includes(a.split(":", 1)[0])
+    );
+    process.stdout.write(
+      `
   Blueprint: ${blueprint.name}
-  \u2714 Scope gate: [${gate.accepted.join(", ")}] \u2014 all data-plane \u2713
+  \u2714 Scope gate: [${acceptedActions.join(", ")}]${roleNote}` + (allDataPlane ? " \u2014 all data-plane \u2713\n" : " \u2014 includes a narrow, allowlisted control-plane exception (see above)\n")
+    );
+    if (blueprint.accessProfile.capabilities?.length) {
+      const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
+      process.stdout.write(`  \u2714 Capability gate: [${capGate.accepted.join(", ")}] \u2014 granted \u2713
 `);
+    }
     let noSeed = args.noSeed;
     let seedDeclinedInteractively = false;
     if (shouldOfferSeedOptOut(args, blueprint, isTty)) {
@@ -17054,6 +18049,7 @@ ${renderPlan(blueprint, planSteps)}
     process.stdout.write(`  \u2714 Bootstrap token minted (5-min TTL, ${args.tenant} tenant)
 `);
     const pingIdentity = deps.resolveIdentity ?? resolveIdentity;
+    const provision = deps.provisionContext ?? provisionContext;
     const resolveIdentities = deps.resolveApplyTimeIdentities ?? resolveApplyTimeIdentities;
     const loader = deps.runLoader ?? runLoader;
     const client = new VectrosClient({ token: bridge.token, environment: baseUrl });
@@ -17064,11 +18060,6 @@ ${renderPlan(blueprint, planSteps)}
         "Could not resolve tenantId from /v1/ping \u2014 the extended ping (tenant_id) must be deployed for bootstrap."
       );
     }
-    const resolvedBlueprint = await resolveIdentities(
-      blueprint,
-      client,
-      log
-    );
     let keyring;
     let keyringOpenError;
     try {
@@ -17077,6 +18068,7 @@ ${renderPlan(blueprint, planSteps)}
       keyringOpenError = err;
     }
     let storedFreshInKeyring = false;
+    const lastResolvedSecret = /* @__PURE__ */ new Map();
     const readExistingKey = async (contextId) => {
       if (!keyring) return void 0;
       const alias = keyringAliasFor(contextId, args.tenant);
@@ -17084,7 +18076,8 @@ ${renderPlan(blueprint, planSteps)}
         const existing = await keyring.get(alias);
         if (!existing?.keyId) return void 0;
         const rawKey = await keyring.resolveSecret(alias);
-        return rawKey ? { keyId: existing.keyId, rawKey } : void 0;
+        lastResolvedSecret.set(alias, rawKey);
+        return rawKey ? { keyId: existing.keyId, rawKey, principalId: existing.principalId } : void 0;
       } catch {
         return void 0;
       }
@@ -17103,6 +18096,11 @@ ${renderPlan(blueprint, planSteps)}
       const alias = keyringAliasFor(contextId, args.tenant);
       try {
         warnReplacingAlias(await keyring.get(alias), alias, record.revokedKeyId);
+        const willActivate = await determineActivateDecision(keyring, {
+          tenant: args.tenant,
+          explicitActivate: args.activate,
+          hint: lastResolvedSecret.has(alias) ? { alias, secret: lastResolvedSecret.get(alias) } : void 0
+        });
         await storeMintedKey(
           keyring,
           {
@@ -17117,11 +18115,14 @@ ${renderPlan(blueprint, planSteps)}
             env: deriveEnvironment(baseUrl) ?? args.env
           },
           record.rawKey,
-          { activate: true, revokedKeyId: record.revokedKeyId }
+          { activate: willActivate, revokedKeyId: record.revokedKeyId }
         );
         if (record.revokedKeyId) {
           await warnOtherAliasesNaming(keyring, record.revokedKeyId, alias);
         }
+        process.stdout.write(
+          tenantActivateMessage({ alias, tenant: args.tenant, willActivate, explicitlyDeclined: args.activate === false })
+        );
         storedFreshInKeyring = true;
       } catch (err) {
         process.stderr.write(
@@ -17133,6 +18134,27 @@ ${renderPlan(blueprint, planSteps)}
         );
       }
     };
+    const remintBootstrapForContext = buildRemintBootstrapForContext({
+      cognitoToken,
+      apiBaseUrl: baseUrl,
+      tenant: args.tenant,
+      useScopedToken: args.useScopedToken,
+      mintBridge
+    });
+    const confirmExistingPrincipal = buildConfirmExistingPrincipal(args, promptCtx.prompt, isTty);
+    const provisioned = await provision(client, {
+      blueprint,
+      allowTenantWideNamespaces: args.allowTenantWideNamespaces,
+      remintBootstrapForContext,
+      readExistingKey,
+      confirmExistingPrincipal,
+      log
+    });
+    const resolvedBlueprint = await resolveIdentities(
+      blueprint,
+      provisioned.ctxBootstrapClient ?? client,
+      log
+    );
     const machineId = await resolveMachineId();
     const result = await loader(client, {
       blueprint: resolvedBlueprint,
@@ -17140,14 +18162,18 @@ ${renderPlan(blueprint, planSteps)}
       machineId,
       rotate: args.rotate,
       skipSeed: noSeed,
+      allowTenantWideNamespaces: args.allowTenantWideNamespaces,
       readExistingKey,
       persistMintedKey,
+      provisioned,
+      remintBootstrapForContext,
       remintForContext: buildRemintForContext({
         cognitoToken,
         apiBaseUrl: baseUrl,
         tenant: args.tenant,
         mintContext
       }),
+      confirmExistingPrincipal,
       log
     });
     process.stdout.write(
@@ -17225,10 +18251,31 @@ ${codeAddHint}`);
 `);
       return 3;
     }
+    if (err instanceof ExistingPrincipalNotConfirmedError) {
+      process.stderr.write(
+        `
+  \u2716 ${err.message}
+
+  If this is expected (a re-apply, or a deliberate second machine for an integration you already own),
+  re-run with --confirm-existing-principal, or confirm interactively.
+  If you don't recognize this identity, investigate the blueprint's servicePrincipal.externalId before re-running.
+`
+      );
+      return 3;
+    }
     if (err instanceof BlueprintIdentityError || err instanceof UnresolvedIdentitiesError) {
+      process.stderr.write(
+        `
+  \u2716 ${err.message}
+  The app-context, service principal, and any declared namespaces were already provisioned. No schemas, profile, roles, key, or seed records were.
+`
+      );
+      return 2;
+    }
+    if (err instanceof TenantWideNamespacesNotAllowedError) {
       process.stderr.write(`
   \u2716 ${err.message}
-  No context or key was provisioned.
+  Nothing was provisioned.
 `);
       return 2;
     }
@@ -17303,11 +18350,14 @@ function assertIdentityOverrideValues(overrides, flag) {
   }
 }
 function placeholderScopeNamespace(value) {
-  const m = /^\$\{\{\s*(?:under\.)?self\.scope\.([^\s}]+)\s*\}\}$/.exec(value);
-  return m ? m[1] : null;
+  const self2 = /^\$\{\{\s*(?:under\.)?self\.scope\.([^\s}]+)\s*\}\}$/.exec(value);
+  if (self2) return self2[1];
+  const member = MEMBER_SCOPE_PLACEHOLDER_RE2.exec(value);
+  return member ? member[1] : null;
 }
 var SELF_PLACEHOLDER_RE = /^\$\{\{\s*self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
-var UNDER_SELF_PLACEHOLDER_RE = /^\$\{\{\s*under\.self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
+var UNDER_SELF_PLACEHOLDER_RE2 = /^\$\{\{\s*under\.self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
+var MEMBER_SCOPE_PLACEHOLDER_RE2 = /^\$\{\{\s*member\.scope\.([a-z][a-z0-9_-]{1,31})(?::[a-z][a-z0-9_-]{1,31})?\s*\}\}$/;
 
 // src/lint.ts
 var ENUM_COMPATIBLE_TYPES = /* @__PURE__ */ new Set(["enum", "string", "string[]"]);
@@ -17445,6 +18495,10 @@ function lintBlueprint(bp) {
       }
     }
   }
+  if (bp.accessProfile.allowedActions !== void 0) {
+    const reached = ownerScopedReachWithoutDataScope(bp.accessProfile.allowedActions, ds);
+    if (reached.length > 0) findings.push(unconstrainedReachFinding("accessProfile", reached));
+  }
   for (const roleId of Object.keys(bp.roles ?? {})) {
     if (!ROLE_ID_RE.test(roleId)) {
       findings.push({
@@ -17457,6 +18511,10 @@ function lintBlueprint(bp) {
   for (const [roleId, clauses] of Object.entries(bp.roles ?? {})) {
     clauses.forEach((clause, i) => {
       const cds = clause.dataScope;
+      const reached = ownerScopedReachWithoutDataScope(clause.allowedActions, cds);
+      if (reached.length > 0) {
+        findings.push(unconstrainedReachFinding(`role '${roleId}' clause ${i}`, reached));
+      }
       if (!cds) return;
       for (const [key, values] of Object.entries(cds)) {
         for (const value of values) {
@@ -17488,7 +18546,12 @@ function lintBlueprint(bp) {
 }
 var ROLE_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
 var PLACEHOLDER_SHAPED_RE = /^\s*\$\{\{.*\}\}\s*$/s;
-var RECOGNIZED_PLACEHOLDER_RES = [/^\$\{\{\s*any\s*\}\}$/, SELF_PLACEHOLDER_RE, UNDER_SELF_PLACEHOLDER_RE];
+var RECOGNIZED_PLACEHOLDER_RES = [
+  /^\$\{\{\s*any\s*\}\}$/,
+  SELF_PLACEHOLDER_RE,
+  UNDER_SELF_PLACEHOLDER_RE2,
+  MEMBER_SCOPE_PLACEHOLDER_RE2
+];
 var BLUEPRINT_TOKEN_RE = /^\s*\$\{\{\s*(identities|inputs|vectros|ns)\./;
 function placeholderFinding(where, key, value) {
   if (typeof value !== "string" || !PLACEHOLDER_SHAPED_RE.test(value)) return null;
@@ -17506,7 +18569,26 @@ function placeholderFinding(where, key, value) {
   return {
     severity: "error",
     rule: "datascope-unknown-placeholder",
-    message: `${where}: dataScope.${key} value '${value}' is not a placeholder the platform recognizes \u2014 it will be rejected at apply. Valid: \${{ any }}, \${{ self.userId }}, \${{ self.scope.<namespace> }}, \${{ under.self.userId }}, \${{ under.self.scope.<namespace> }}. Spelling is exact and lowercase; use a plain value for a literal owner id.`
+    message: `${where}: dataScope.${key} value '${value}' is not a placeholder the platform recognizes \u2014 it will be rejected at apply. Valid: \${{ any }}, \${{ self.userId }}, \${{ self.scope.<namespace> }}, \${{ under.self.userId }}, \${{ under.self.scope.<namespace> }}, \${{ member.scope.<namespace> }}, \${{ member.scope.<namespace>:<level> }}. Spelling is exact and lowercase; use a plain value for a literal owner id.`
+  };
+}
+var OWNER_SCOPED_RESOURCES = /* @__PURE__ */ new Set(["records", "documents", "entities"]);
+var UNCONSTRAINED_REACH_OPS = /* @__PURE__ */ new Set(["r", "u", "d"]);
+function ownerScopedReachWithoutDataScope(allowedActions, dataScope) {
+  const reached = /* @__PURE__ */ new Set();
+  for (const action of allowedActions) {
+    const [resource, ops] = action.split(":", 2);
+    if (!resource || !ops || !OWNER_SCOPED_RESOURCES.has(resource)) continue;
+    if (ops === "*" || [...ops].some((op) => UNCONSTRAINED_REACH_OPS.has(op))) reached.add(resource);
+  }
+  if (dataScope !== void 0) return [];
+  return [...reached].sort();
+}
+function unconstrainedReachFinding(where, resources) {
+  return {
+    severity: "warning",
+    rule: "datascope-absent-unconstrained-reach",
+    message: `${where}: no dataScope at all, but allowedActions grants r/u/d on ${resources.join("/")} \u2014 this reaches EVERY row of EVERY owner on ${resources.length > 1 ? "those resources" : "that resource"}, not just "your own org" or any other value you may have intended. If that's deliberate (a genuinely shared/tenant-wide resource), you can ignore this; otherwise add a dataScope entry.`
   };
 }
 function lintPasses(findings) {
@@ -17547,8 +18629,12 @@ schemas:
     lookupFields: [title]      # extra O(1) exact-match lookup indexes (max 10)
 
 accessProfile:
-  # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference/entities).
-  # Anything else (keys/profiles/users/admin/namespaces/*) is HARD-REJECTED \u2014 by design, no override.
+  # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference/entities),
+  # PLUS profiles:r/u/d (bounded by the platform to redistributing access you already have,
+  # never granting more) and profiles:c:self (create a profile for yourself only \u2014 the
+  # platform resolves "self" from the caller, not from anything you declare here). A bare
+  # profiles:c, or profiles:c:usr_<id> naming another principal, is HARD-REJECTED \u2014 by
+  # design, no override. Same for keys/users/admin/namespaces/*.
   # Ops: c|r|u|d, combinable (records:cru). Prefer the narrowest set (least privilege).
   allowedActions: [records:r, records:c, records:u, search:r, schemas:r]
   # dataScope binds the key to specific owners. Include null to ALSO see
@@ -17556,6 +18642,17 @@ accessProfile:
   # owners' records, not shared/seed data. Keys are userId (the principal) and
   # namespaced scopes (scope:org, scope:client, ...):
   # dataScope: { "scope:org": [<org-uuid>, null] }
+  # Left empty ({}) below \u2014 the explicit marker for "deliberately tenant-wide,
+  # every record visible" ('blueprint validate' warns on a MISSING dataScope
+  # key, but not on this one). This is a SCAFFOLD PLACEHOLDER, not a
+  # recommendation: it also grants records:c/u tenant-wide, so before this
+  # profile touches real data, replace it with a real scope (the example
+  # above) unless every owner genuinely sharing every record is what you want.
+  dataScope: {}
+  # capabilities is a SEPARATE gated dimension from allowedActions \u2014 named platform
+  # effects a resource:ops verb can't express. Only 'member-lifecycle' is admitted
+  # today; every other name is HARD-REJECTED, same posture as the scope gate above.
+  # capabilities: [member-lifecycle]
 
 servicePrincipal:
   externalId: ${name}-sp       # stable; the principal the profile + key bind to
@@ -17675,15 +18772,19 @@ async function resolveAndValidate(arg, verb, supplied) {
     return null;
   }
   try {
-    assertScopeGate(blueprint.accessProfile.allowedActions);
-    for (const clauses of Object.values(blueprint.roles ?? {})) {
-      for (const clause of clauses) assertScopeGate(clause.allowedActions);
-    }
+    assertBlueprintGates(blueprint);
   } catch (err) {
     if (err instanceof ScopeGateError) {
       process.stderr.write(`  \u2716 Scope gate rejected '${blueprint.name}':
 `);
       for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+      return null;
+    }
+    if (err instanceof CapabilityGateError) {
+      process.stderr.write(`  \u2716 Capability gate rejected '${blueprint.name}':
+`);
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
       return null;
     }
@@ -17714,10 +18815,11 @@ async function runValidate(args) {
   }
   const blueprint = await resolveAndValidate(args.file, "validate", supplied);
   if (!blueprint) return 2;
-  const gate = evaluateScopeGate(blueprint.accessProfile.allowedActions);
+  const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
   const warnCount = lintBlueprint(blueprint).length;
+  const roleNote = blueprint.accessProfile.roleIds ? ` via role(s) [${blueprint.accessProfile.roleIds.join(", ")}]` : "";
   process.stdout.write(
-    `  \u2714 '${blueprint.name}' is valid \u2014 structural \u2713, scope gate \u2713 [${gate.accepted.join(", ")}], lint \u2713` + (warnCount ? ` (${warnCount} warning${warnCount === 1 ? "" : "s"})` : "") + "\n"
+    `  \u2714 '${blueprint.name}' is valid \u2014 structural \u2713, scope gate \u2713 [${effectiveAccessProfileActions(blueprint).join(", ")}]${roleNote}` + (capGate.accepted.length ? `, capability gate \u2713 [${capGate.accepted.join(", ")}]` : "") + `, lint \u2713` + (warnCount ? ` (${warnCount} warning${warnCount === 1 ? "" : "s"})` : "") + "\n"
   );
   return 0;
 }
@@ -18048,7 +19150,14 @@ async function resolveKeyDestination(opts, deps) {
 `);
     return 2;
   }
-  const alias = opts.alias ?? opts.context;
+  let alias;
+  try {
+    alias = keyringAliasFor(opts.alias ?? opts.context, opts.tenant ?? "live");
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
   if (opts.activate === false && await keyring.activeAlias() === alias) {
     process.stderr.write(
       `  \u2716 --no-activate cannot be used on '${alias}': it is your ACTIVE identity, and storing
@@ -18069,6 +19178,8 @@ async function storeAndReport(dest, key, auth, opts) {
     return 1;
   }
   const principalId = opts.principalId;
+  const tenant = keyTenant(key.rawKey) ?? "test";
+  const willActivate = await determineActivateDecision(dest.keyring, { tenant, explicitActivate: opts.activate });
   let entry;
   try {
     warnReplacingAlias(await dest.keyring.get(dest.alias), dest.alias, opts.revokedKeyId);
@@ -18083,7 +19194,7 @@ async function storeAndReport(dest, key, auth, opts) {
         env: auth.env
       },
       key.rawKey,
-      { activate: opts.activate !== false, revokedKeyId: opts.revokedKeyId }
+      { activate: willActivate, revokedKeyId: opts.revokedKeyId }
     ));
   } catch (err) {
     process.stderr.write(
@@ -18095,7 +19206,6 @@ async function storeAndReport(dest, key, auth, opts) {
     );
     return 1;
   }
-  const active = opts.activate !== false;
   process.stdout.write(
     `
   \u2714 Stored the new key in your ${describeEntryStoreNoun(entry)} \u2014 it was not printed.
@@ -18105,9 +19215,19 @@ async function storeAndReport(dest, key, auth, opts) {
       ["principal", entry.principalId || void 0],
       ["key id", entry.keyId],
       ["env", entry.env],
-      ["active", active ? "yes" : "no"]
-    ]) + "\n\n" + (active ? "  Anything that resolves a key through the CLI \u2014 the MCP server included \u2014 now\n  reads this one. No VECTROS_API_KEY needed.\n" : `  Not active. Run \`vectros switch ${entry.alias}\` to use it.
-`)
+      ["active", willActivate ? "yes" : "no"]
+    ]) + "\n\n" + // The plain "now active" note fires only on the activated path. When it
+    // did NOT activate, tenantActivateMessage below is the ONLY explanation —
+    // it already says to run `switch`, AND (unlike a bare "Not active") says
+    // WHY: an explicit --no-activate vs. this call's tenant-safety default.
+    // Saying both here would print two different "run switch" instructions
+    // for one outcome.
+    (willActivate ? "  Anything that resolves a key through the CLI \u2014 the MCP server included \u2014 now\n  reads this one. No VECTROS_API_KEY needed.\n" : "") + tenantActivateMessage({
+      alias: entry.alias,
+      tenant,
+      willActivate,
+      explicitlyDeclined: opts.activate === false
+    })
   );
   return 0;
 }
@@ -18570,6 +19690,52 @@ async function runIdentityDelete(opts, deps = {}) {
     }
   });
 }
+function renderInvite(v) {
+  return formatKeyValues([
+    ["userId", v.userId],
+    ["inviteExpiresAt", v.inviteExpiresAt],
+    ["emailSent", v.emailSent === void 0 ? void 0 : String(v.emailSent)],
+    ["inviteToken", v.inviteToken],
+    ["acceptLink", v.acceptLink]
+  ]);
+}
+async function runIdentityInvite(opts, deps = {}) {
+  const sendEmail = !opts.noSendEmail;
+  if (sendEmail && !opts.acceptUrl) {
+    process.stderr.write(
+      "  \u2716 --accept-url is required unless --no-send-email is given (the platform delivers the invitation email itself and needs somewhere to point it).\n"
+    );
+    return 2;
+  }
+  return withAuth(opts, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const invite = await client.auth.createInvite({
+        email: opts.email,
+        contextId: opts.context,
+        accessProfile: { roleId: opts.role },
+        firstName: opts.firstName,
+        acceptUrl: opts.acceptUrl,
+        sendEmail
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(invite)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        `
+  \u2714 Invited '${opts.email}' to '${opts.context}' as '${opts.role}'
+${renderInvite(invite)}
+`
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "identity invite failed" }));
+      return 1;
+    }
+  });
+}
 
 // src/commands/access.ts
 function assertPrincipalShape(principal) {
@@ -18588,20 +19754,24 @@ async function resolvePrincipalArg(raw, auth) {
   }
   return self2.principalId;
 }
+function roleSummary(p) {
+  if (p.roleIds?.length) return p.roleIds.join(", ");
+  return p.roleId;
+}
 function renderProfile(p) {
   return formatKeyValues([
     ["context", p.contextId],
     ["principal", p.principalId],
-    ["role", p.roleId],
+    ["role", roleSummary(p)],
     ["scopes", p.scopes?.length ? `${p.scopes.length} clause(s)` : void 0],
     ["status", p.status]
   ]);
 }
 async function runAccessGrant(opts, deps = {}) {
-  const hasRole = Boolean(opts.role);
+  const hasRole = Boolean(opts.role?.length);
   const hasActions = Boolean(opts.actions);
   if (hasRole === hasActions) {
-    process.stderr.write("  \u2716 Provide exactly one of --role <roleId> or --actions <csv>.\n");
+    process.stderr.write("  \u2716 Provide exactly one of --role <roleId> (repeatable) or --actions <csv>.\n");
     return 2;
   }
   if (hasActions && splitCsv(opts.actions).length === 0) {
@@ -18641,7 +19811,11 @@ async function runAccessGrant(opts, deps = {}) {
         upsert: true,
         body: {
           principalId: principal,
-          roleId: opts.role,
+          // Always send the plural `roleIds`, even for a single
+          // `--role`: it is a strict superset of the deprecated singular
+          // `roleId` (equivalent to `roleIds: ["<value>"]`), and the platform
+          // reads it uniformly regardless of how many roles compose.
+          roleIds: opts.role,
           scopes,
           identityOverrides
         }
@@ -18653,7 +19827,7 @@ async function runAccessGrant(opts, deps = {}) {
       }
       process.stdout.write(
         `
-  \u2714 Granted ${principal} in '${opts.context}'` + (hasRole ? ` via role '${opts.role}'` : ` with ${splitCsv(opts.actions).length} action(s)`) + `
+  \u2714 Granted ${principal} in '${opts.context}'` + (hasRole ? ` via role(s) [${opts.role.join(", ")}]` : ` with ${splitCsv(opts.actions).length} action(s)`) + `
 ${renderProfile(profile)}
 `
       );
@@ -18722,7 +19896,7 @@ async function runAccessList(opts, deps = {}) {
         "\n" + formatTable(rows, [
           { header: "context", get: (r) => r.contextId },
           { header: "principal", get: (r) => r.principalId },
-          { header: "role", get: (r) => r.roleId ?? (r.scopes?.length ? "(inline)" : void 0) },
+          { header: "role", get: (r) => roleSummary(r) ?? (r.scopes?.length ? "(inline)" : void 0) },
           { header: "status", get: (r) => r.status }
         ]) + "\n"
       );
@@ -18770,6 +19944,7 @@ ${renderProfile(p)}
 var SELF = /* @__PURE__ */ Symbol("self");
 var ANY = /* @__PURE__ */ Symbol("any");
 var UNDER_SELF = /* @__PURE__ */ Symbol("under.self");
+var MEMBER = /* @__PURE__ */ Symbol("member.scope");
 function canonicalDim(key) {
   if (key === "userId" || key === "partnerUserId") return "user";
   return key;
@@ -18799,7 +19974,8 @@ function normalizeClauses(raw) {
         if (val === null) return null;
         const s = String(val);
         if (ANY_TOKEN_RE.test(s)) return ANY;
-        if (UNDER_SELF_PLACEHOLDER_RE.test(s)) return UNDER_SELF;
+        if (UNDER_SELF_PLACEHOLDER_RE2.test(s)) return UNDER_SELF;
+        if (MEMBER_SCOPE_PLACEHOLDER_RE2.test(s)) return MEMBER;
         return SELF_PLACEHOLDER_RE.test(s) ? SELF : s;
       });
       if (!isRecognizedOwnershipKey(k)) unrecognizedDims.push(k);
@@ -18854,7 +20030,7 @@ function buildArchetypes(clauses) {
       const set = scopeDims.get(dim) ?? /* @__PURE__ */ new Set();
       set.add(SELF);
       for (const v of values) {
-        if (v === null || v === ANY || v === UNDER_SELF) continue;
+        if (v === null || v === ANY || v === UNDER_SELF || v === MEMBER) continue;
         set.add(v);
       }
       scopeDims.set(dim, set);
@@ -18881,6 +20057,7 @@ function listAdmits(allowed, recordValue) {
     if (a === SELF) return recordValue === SELF;
     if (a === ANY) return recordValue !== void 0;
     if (a === UNDER_SELF) return false;
+    if (a === MEMBER) return false;
     return recordValue === a;
   });
 }
@@ -18906,7 +20083,7 @@ function undecidableDims(clauses) {
   const dims = /* @__PURE__ */ new Set();
   for (const c of clauses) {
     for (const [dim, values] of Object.entries(c.dataScope)) {
-      if (values.includes(UNDER_SELF)) dims.add(dim);
+      if (values.includes(UNDER_SELF) || values.includes(MEMBER)) dims.add(dim);
     }
   }
   return [...dims];
@@ -18939,6 +20116,7 @@ function renderDataScope(ds) {
       if (v === SELF) return "self";
       if (v === ANY) return "any";
       if (v === UNDER_SELF) return "under-self";
+      if (v === MEMBER) return "member";
       if (v === null) return "null";
       return v;
     });
@@ -18970,14 +20148,25 @@ async function runAccessExplain(opts, deps = {}) {
       const profile = await client.auth.getAccessProfile({ contextId: opts.context, principalId: principal });
       let rawClauses = profile.scopes ?? [];
       let via = "inline scopes";
-      if (profile.roleId) {
-        const role = await client.auth.getRole({ contextId: opts.context, roleId: profile.roleId });
-        rawClauses = role.scopes ?? [];
-        via = `role '${profile.roleId}'`;
+      const roleIds = profile.roleIds ?? (profile.roleId ? [profile.roleId] : []);
+      if (roleIds.length > 0) {
+        const roleClauses = [];
+        for (const roleId of roleIds) {
+          const role = await client.auth.getRole({ contextId: opts.context, roleId });
+          roleClauses.push(...role.scopes ?? []);
+        }
+        rawClauses = roleClauses;
+        via = roleIds.length === 1 ? `role '${roleIds[0]}'` : `role(s) [${roleIds.join(", ")}]`;
       }
       const clauses = normalizeClauses(rawClauses);
       const rows = explainClauses(clauses);
       const undecidable = undecidableDims(clauses);
+      const hasUnderSelfUndecidable = clauses.some(
+        (c) => Object.values(c.dataScope).some((values) => values.includes(UNDER_SELF))
+      );
+      const hasMemberUndecidable = clauses.some(
+        (c) => Object.values(c.dataScope).some((values) => values.includes(MEMBER))
+      );
       if (opts.json) {
         process.stdout.write(
           `${formatJson({
@@ -19034,10 +20223,7 @@ async function runAccessExplain(opts, deps = {}) {
         ]) + (undecidable.length > 0 ? `
 
   \u26A0 UNDECIDED offline: ${undecidable.join(", ")}
-  A clause matching on \`\${{ under.self.* }}\` needs the parent graph, which only the server has,
-  so rows granted through it are shown as NO above. Read those cells as "cannot tell here",
-  NOT as a denial \u2014 the matrix under-reports this clause.
-` : "") + '\n\n  \u26A0 READ ONLY: "granted?"/"actions" model whether a row can be READ, not whether a c/u/d\n  verb shown there can actually WRITE that row\'s exact shape \u2014 the platform requires a clause\n  to name a dimension to place a value into it, while reads are never narrowed by a dimension a\n  clause omits. A create/update verb next to a row is advisory: it names which records exist to\n  act on, not that a specific write will succeed.\n\n\n  NOTE: this matrix models the OWNERSHIP dimensions only \u2014 "granted?" says a row\'s ownership\n  shape matches a clause, and "record types" (above) says which `records:` types that grant\n  actually reaches; "all" reaches every type, "\u2014" means no `records:` action grants this row at\n  all. Search/RAG visibility is a separate, still-unmodeled narrowing: it is bounded per row by\n  the SAME clause\'s typed read grants \u2014 a row shown with `search:r` is searchable only for the\n  content types that clause can read.\n  Preview only \u2014 computed client-side from the documented matching rules; the platform decides at request time.\n'
+` + (hasUnderSelfUndecidable ? "  A clause matching on `${{ under.self.* }}` needs the server's parent graph, which this\n  preview does not have, so rows granted through it are shown as NO above.\n" : "") + (hasMemberUndecidable ? "  A clause matching on `${{ member.scope.<ns>[:<level>] }}` needs a live per-request read of\n  this account's membership records, which this preview does not have, so rows granted\n  through it are shown as NO above.\n" : "") + '  Read those cells as "cannot tell here", NOT as a denial \u2014 the matrix under-reports\n  whichever clause(s) above are responsible.\n' : "") + '\n\n  \u26A0 READ ONLY: "granted?"/"actions" model whether a row can be READ, not whether a c/u/d\n  verb shown there can actually WRITE that row\'s exact shape \u2014 the platform requires a clause\n  to name a dimension to place a value into it, while reads are never narrowed by a dimension a\n  clause omits. A create/update verb next to a row is advisory: it names which records exist to\n  act on, not that a specific write will succeed.\n\n\n  NOTE: this matrix models the OWNERSHIP dimensions only \u2014 "granted?" says a row\'s ownership\n  shape matches a clause, and "record types" (above) says which `records:` types that grant\n  actually reaches; "all" reaches every type, "\u2014" means no `records:` action grants this row at\n  all. Search/RAG visibility is a separate, still-unmodeled narrowing: it is bounded per row by\n  the SAME clause\'s typed read grants \u2014 a row shown with `search:r` is searchable only for the\n  content types that clause can read.\n  Preview only \u2014 computed client-side from the documented matching rules; the platform decides at request time.\n'
       );
       return 0;
     } catch (err) {
@@ -19055,7 +20241,8 @@ function renderRole(r) {
     ["name", r.name],
     ["context", r.contextId],
     ["description", r.description],
-    ["scopes", r.scopes?.length ? `${r.scopes.length} clause(s)` : void 0]
+    ["scopes", r.scopes?.length ? `${r.scopes.length} clause(s)` : void 0],
+    ["assumable", r.assumable && Object.keys(r.assumable).length ? formatJson(r.assumable) : void 0]
   ]);
 }
 async function runRoleCreate(opts, deps = {}) {
@@ -19326,6 +20513,75 @@ ${renderContext(ctx)}
   });
 }
 
+// src/commands/issuers.ts
+function renderSelfSignup(policies) {
+  if (!policies || policies.length === 0) return "\u2014";
+  return policies.map((p) => `${p.signup_type} \u2192 ${p.role_id}`).join(", ");
+}
+function renderIssuer(i) {
+  return formatKeyValues([
+    ["issuerId", i.issuerId],
+    ["issuer", i.issuer],
+    ["jwksUri", i.jwksUri],
+    ["audience", i.audience],
+    ["contextId", i.contextId],
+    ["subClaim", i.subClaim],
+    ["emailClaim", i.emailClaim],
+    ["userinfoUri", i.userinfoUri],
+    ["status", i.status],
+    ["createdAt", i.createdAt],
+    ["selfSignup", renderSelfSignup(i.selfSignupPolicies)]
+  ]);
+}
+async function runIssuersList(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const rows = await drainPages(
+        (startFrom) => client.auth.listIssuers({ limit: PAGE_LIMIT, ...startFrom ? { startFrom } : {} })
+      );
+      if (opts.json) {
+        process.stdout.write(`${formatJson(rows)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        "\n" + formatTable(rows, [
+          { header: "issuerId", get: (i) => i.issuerId },
+          { header: "issuer", get: (i) => i.issuer },
+          { header: "audience", get: (i) => i.audience },
+          { header: "status", get: (i) => i.status },
+          { header: "self-signup", get: (i) => renderSelfSignup(i.selfSignupPolicies) }
+        ]) + "\n"
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "issuers list failed" }));
+      return 1;
+    }
+  });
+}
+async function runIssuersGet(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const issuer = await client.auth.getIssuer({ issuerId: opts.issuerId });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(issuer)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+${renderIssuer(issuer)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "issuers get failed" }));
+      return 1;
+    }
+  });
+}
+
 // src/commands/login.ts
 var import_node_http = require("http");
 var import_open = __toESM(require("open"));
@@ -19547,7 +20803,7 @@ async function runAssertions(client, bootstrapClient, deps, blueprint, tenantId,
   const assertions = [];
   try {
     const ping = await deps.pingWithKey(result.rawKey);
-    const wantActions = blueprint.accessProfile.allowedActions;
+    const wantActions = effectiveAccessProfileActions(blueprint);
     const got = ping.allowedActions ?? [];
     const missing = wantActions.filter((a) => !got.includes(a));
     const ok = ping.principalType === "scoped_key" && ping.tenantId === tenantId && missing.length === 0;
@@ -19641,6 +20897,19 @@ async function runAssertions(client, bootstrapClient, deps, blueprint, tenantId,
       assertions.push({ name: `issuer:${issuerId}`, ok: false, detail: `getIssuer(${issuerId}) failed: ${errMsg(e)}` });
     }
   }
+  for (const { namespace } of result.namespaceActions) {
+    try {
+      const ns = await bootstrapClient.identity.getNamespace({ namespace, contextId: blueprint.contextId });
+      const ok = ns.namespace === namespace && ns.contextId === blueprint.contextId;
+      assertions.push({
+        name: `namespace:${namespace}`,
+        ok,
+        detail: ok ? `namespace '${namespace}' registered + readable in context '${blueprint.contextId}'` : `getNamespace(${namespace}) returned namespace '${ns.namespace ?? "(none)"}' in context '${ns.contextId ?? "(tenant-wide)"}', expected '${blueprint.contextId}'`
+      });
+    } catch (e) {
+      assertions.push({ name: `namespace:${namespace}`, ok: false, detail: `getNamespace(${namespace}) failed: ${errMsg(e)}` });
+    }
+  }
   return assertions;
 }
 async function runTeardown(client, bootstrapClient, blueprint, machineId, snapshot, result) {
@@ -19753,19 +21022,36 @@ async function runTeardown(client, bootstrapClient, blueprint, machineId, snapsh
       steps.push({ step: `delete issuer ${issuerId}`, ok: false, error: errMsg(e) });
     }
   }
+  for (const { namespace } of result.namespaceActions) {
+    steps.push({
+      step: `delete namespace ${namespace}`,
+      ok: true,
+      skipped: true,
+      error: "namespace deletion requires a root API key (sk_*) \u2014 blueprint-test never holds one; the registration is left in place"
+    });
+  }
   return steps;
 }
 async function runBlueprintHarness(client, input, deps) {
-  const { tenantId, machineId, keep = false, log, remintForContext } = input;
+  const { tenantId, machineId, keep = false, log, remintForContext, remintBootstrapForContext } = input;
   const readExistingKey = async () => void 0;
   const persistMintedKey = async () => {
   };
+  const provisioned = await provisionContext(client, {
+    blueprint: input.blueprint,
+    remintBootstrapForContext,
+    readExistingKey,
+    log
+  });
   const blueprint = await resolveApplyTimeIdentities(
     input.blueprint,
-    client,
+    provisioned.ctxBootstrapClient ?? client,
     log
   );
   const remint = remintForContext ?? (async () => client);
+  const remintBootstrap = remintBootstrapForContext ?? (async () => client);
+  const hasIssuers = (blueprint.issuers ?? []).length > 0;
+  const hasNamespaces = provisioned.namespaceActions.length > 0;
   let contextSnapshot;
   if (remintForContext) {
     try {
@@ -19781,7 +21067,18 @@ async function runBlueprintHarness(client, input, deps) {
   } else {
     contextSnapshot = await captureSnapshot(client, blueprint);
   }
-  const issuerSnapshot = await captureIssuerSnapshot(client);
+  let issuerSnapshot;
+  if (!hasIssuers) {
+    issuerSnapshot = { existingIssuerIds: /* @__PURE__ */ new Set(), failed: false };
+  } else if (remintBootstrapForContext) {
+    try {
+      issuerSnapshot = await captureIssuerSnapshot(await remintBootstrapForContext(blueprint.contextId));
+    } catch (e) {
+      issuerSnapshot = { existingIssuerIds: /* @__PURE__ */ new Set(), failed: !isNotFound(e) };
+    }
+  } else {
+    issuerSnapshot = await captureIssuerSnapshot(client);
+  }
   const snapshot = {
     ...contextSnapshot,
     existingIssuerIds: issuerSnapshot.existingIssuerIds,
@@ -19791,9 +21088,26 @@ async function runBlueprintHarness(client, input, deps) {
   let assertions = [];
   let applyError;
   try {
-    result = await runLoader(client, { blueprint, tenantId, machineId, readExistingKey, persistMintedKey, log, remintForContext });
+    result = await runLoader(client, {
+      blueprint,
+      tenantId,
+      machineId,
+      readExistingKey,
+      persistMintedKey,
+      log,
+      provisioned,
+      remintForContext,
+      remintBootstrapForContext
+    });
     log.debug({ component: "harness", contextId: result.contextId, keyName: result.keyName }, "applied");
-    assertions = await runAssertions(await remint(blueprint.contextId), client, deps, blueprint, tenantId, result);
+    assertions = await runAssertions(
+      await remint(blueprint.contextId),
+      hasIssuers || hasNamespaces ? await remintBootstrap(blueprint.contextId) : client,
+      deps,
+      blueprint,
+      tenantId,
+      result
+    );
   } catch (e) {
     applyError = errMsg(e);
     log.warn({ component: "harness", err: applyError }, "apply phase failed");
@@ -19805,7 +21119,14 @@ async function runBlueprintHarness(client, input, deps) {
       tdClient = await remint(blueprint.contextId);
     } catch {
     }
-    teardown = await runTeardown(tdClient, client, blueprint, machineId, snapshot, result);
+    let tdBootstrapClient = client;
+    if (hasIssuers) {
+      try {
+        tdBootstrapClient = await remintBootstrap(blueprint.contextId);
+      } catch {
+      }
+    }
+    teardown = await runTeardown(tdClient, tdBootstrapClient, blueprint, machineId, snapshot, result);
   }
   const passed = applyError === void 0 && assertions.length > 0 && assertions.every((a) => a.ok);
   return {
@@ -19879,6 +21200,13 @@ async function runBlueprintTest(fileOrName, opts, deps = {}) {
       process.stderr.write(`  \u2716 Scope gate refused blueprint:
 `);
       for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+`);
+      return 2;
+    }
+    if (err instanceof CapabilityGateError) {
+      process.stderr.write(`  \u2716 Capability gate refused blueprint:
+`);
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
 `);
       return 2;
     }
@@ -19914,9 +21242,22 @@ async function runBlueprintTest(fileOrName, opts, deps = {}) {
           environment: auth.baseUrl
         });
       };
+      const remintBootstrapForContext = async (contextId) => {
+        const ctxToken = await mintBridgeToken({
+          cognitoToken: auth.cognitoToken,
+          apiBaseUrl: auth.baseUrl,
+          contextId,
+          tenant: auth.tenant,
+          useScopedToken: opts.useScopedToken
+        });
+        return new VectrosClient({
+          token: ctxToken.token,
+          environment: auth.baseUrl
+        });
+      };
       const report = await runBlueprintHarness(
         client,
-        { blueprint, tenantId, machineId, keep: opts.keep, log, remintForContext },
+        { blueprint, tenantId, machineId, keep: opts.keep, log, remintForContext, remintBootstrapForContext },
         { pingWithKey }
       );
       if (opts.json) {
@@ -19973,12 +21314,13 @@ async function issueOrRotateKey(client, tenantId, context, userId, keyName) {
   return { key: rotated, revokedKeyId: existing?.keyId };
 }
 async function runJoin(opts, deps = {}) {
-  const hasRole = Boolean(opts.role);
+  const hasRole = Boolean(opts.role?.length);
   const hasActions = Boolean(opts.actions);
   if (hasRole === hasActions) {
-    process.stderr.write("  \u2716 Provide exactly one of --role <roleId> or --actions <csv>.\n");
+    process.stderr.write("  \u2716 Provide exactly one of --role <roleId> (repeatable) or --actions <csv>.\n");
     return 2;
   }
+  const roleDisplay = opts.role?.join(", ");
   if (hasActions && splitCsv(opts.actions).length === 0) {
     process.stderr.write("  \u2716 --actions needs at least one action (an empty/blank list grants nothing).\n");
     return 2;
@@ -19997,9 +21339,10 @@ async function runJoin(opts, deps = {}) {
     return 2;
   }
   const context = opts.contextArg;
+  const tenant = opts.tenant ?? "live";
   let alias;
   try {
-    alias = keyringAliasFor(opts.alias ?? context, opts.tenant ?? "live");
+    alias = keyringAliasFor(opts.alias ?? context, tenant);
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
@@ -20025,7 +21368,10 @@ async function runJoin(opts, deps = {}) {
         upsert: true,
         body: {
           principalId,
-          roleId: opts.role,
+          // Always send the plural `roleIds`, even for a single
+          // `--role`: a strict superset of the deprecated singular `roleId`,
+          // read uniformly by the platform regardless of how many compose.
+          roleIds: opts.role,
           scopes,
           identityOverrides
         }
@@ -20034,8 +21380,23 @@ async function runJoin(opts, deps = {}) {
       const heldSecret = existingEntry ? await keyring.resolveSecret(alias) : void 0;
       const canReuse = existingEntry && heldSecret && existingEntry.context === context && existingEntry.principalId === principalId && existingEntry.env === auth.env;
       if (canReuse && existingEntry) {
-        await keyring.setActive(alias);
-        emitJoined(alias, context, principalId, opts.role, existingEntry.keyId, true);
+        const willActivate2 = await determineActivateDecision(keyring, {
+          tenant,
+          explicitActivate: opts.activate,
+          hint: { alias, secret: heldSecret }
+        });
+        if (willActivate2) await keyring.setActive(alias);
+        emitJoined({
+          alias,
+          context,
+          principalId,
+          role: roleDisplay,
+          keyId: existingEntry.keyId,
+          reused: true,
+          tenant,
+          willActivate: willActivate2,
+          explicitlyDeclined: opts.activate === false
+        });
         return 0;
       }
       warnReplacingAlias(existingEntry, alias);
@@ -20047,13 +21408,24 @@ async function runJoin(opts, deps = {}) {
         );
       }
       if (revokedKeyId) await warnOtherAliasesNaming(keyring, revokedKeyId, alias);
+      const willActivate = await determineActivateDecision(keyring, { tenant, explicitActivate: opts.activate });
       const { entry } = await storeMintedKey(
         keyring,
-        { alias, context, principalId, role: opts.role, keyId: key.keyId, env: auth.env },
+        { alias, context, principalId, role: roleDisplay, keyId: key.keyId, env: auth.env },
         key.rawKey,
-        { revokedKeyId }
+        { activate: willActivate, revokedKeyId }
       );
-      emitJoined(alias, context, principalId, opts.role, entry.keyId, false);
+      emitJoined({
+        alias,
+        context,
+        principalId,
+        role: roleDisplay,
+        keyId: entry.keyId,
+        reused: false,
+        tenant,
+        willActivate,
+        explicitlyDeclined: opts.activate === false
+      });
       return 0;
     } catch (err) {
       process.stderr.write(formatCliError(err, { action: "join failed" }));
@@ -20061,27 +21433,34 @@ async function runJoin(opts, deps = {}) {
     }
   });
 }
-function emitJoined(alias, context, principalId, role, keyId, reused) {
-  process.stdout.write(
-    `
-  \u2714 Joined '${context}' as ${principalId}` + (reused ? " (existing key reused)" : "") + "\n" + formatKeyValues([
-      ["alias", alias],
-      ["context", context],
-      ["principal", principalId],
-      ["role", role],
-      ["key id", keyId]
-    ]) + `
+function emitJoined(opts) {
+  const header = `
+  \u2714 Joined '${opts.context}' as ${opts.principalId}` + (opts.reused ? " (existing key reused)" : "") + "\n" + formatKeyValues([
+    ["alias", opts.alias],
+    ["context", opts.context],
+    ["principal", opts.principalId],
+    ["role", opts.role],
+    ["key id", opts.keyId]
+  ]);
+  const activationNote = opts.willActivate ? `
 
-  Now active. Use \`vectros switch ${alias}\` to return to it, \`vectros keyring show --format env\` to export the key for the MCP server.
-`
+  Now active. Use \`vectros switch ${opts.alias}\` to return to it, \`vectros keyring show --format env\` to export the key for the MCP server.
+` : "";
+  process.stdout.write(
+    header + activationNote + tenantActivateMessage({
+      alias: opts.alias,
+      tenant: opts.tenant,
+      willActivate: opts.willActivate,
+      explicitlyDeclined: opts.explicitlyDeclined
+    })
   );
 }
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.15.0" : "dev",
-  sdk: true ? "0.39.0" : "dev",
-  blueprints: true ? "0.12.0" : "dev"
+  cli: true ? "0.19.0" : "dev",
+  sdk: true ? "0.41.0" : "dev",
+  blueprints: true ? "0.16.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -20105,6 +21484,14 @@ function addCommonAuthOptions(cmd) {
     "emit machine-readable JSON instead of the human-readable view"
   );
 }
+function parseTenantFlag(raw) {
+  if (raw !== void 0 && raw !== "test" && raw !== "live") {
+    process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${raw}')
+`);
+    process.exit(2);
+  }
+  return raw;
+}
 function toCommonOptions(flags) {
   return {
     env: flags.env,
@@ -20153,12 +21540,16 @@ function buildProgram(deps = {}) {
   registerAccessCommands(program, deps);
   registerRoleCommands(program, deps);
   registerContextCommands(program, deps);
+  registerIssuersCommands(program, deps);
   registerJoinCommand(program, deps);
   registerKeyringCommands(program);
   return program;
 }
 function registerJoinCommand(program, deps) {
-  const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (XOR --actions)").option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
+  const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option(
+    "--activate",
+    "force the freshly-stored key to become your active identity, even over a currently-active LIVE credential (the one case --tenant test does NOT do automatically)"
+  ).option("--no-activate", "store the key without activating it, regardless of tenant");
   addAuthOptions(join3).action(
     async (contextArg, flags) => {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
@@ -20176,7 +21567,8 @@ function registerJoinCommand(program, deps) {
             as: flags.as,
             scope: flags.scope,
             alias: flags.alias,
-            tenant: flags.tenant
+            tenant: flags.tenant,
+            activate: flags.activate
           },
           deps
         )
@@ -20288,6 +21680,27 @@ function registerContextCommands(program, deps) {
     }
   );
 }
+function registerIssuersCommands(program, deps) {
+  const issuers = program.command("issuers").description("Inspect registered third-party IdP issuers (token-exchange trust anchors).");
+  const list = issuers.command("list").description("List issuers registered in one app context.").requiredOption("--context <c>", "app context the issuer(s) are registered under").option("--tenant <tenant>", "tenant to read: 'test' or 'live' (default live)");
+  addCommonAuthOptions(list).action(
+    async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(
+        await runIssuersList({ ...toCommonOptions(flags), context: flags.context, tenant }, deps)
+      );
+    }
+  );
+  const get = issuers.command("get").description("Show one registered issuer.").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--tenant <tenant>", "tenant to read: 'test' or 'live' (default live)");
+  addCommonAuthOptions(get).action(
+    async (issuerId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(
+        await runIssuersGet({ ...toCommonOptions(flags), context: flags.context, issuerId, tenant }, deps)
+      );
+    }
+  );
+}
 function registerRoleCommands(program, deps) {
   const role = program.command("role").description("Manage context-scoped roles (reusable scope rules; bind via `access grant --role`).");
   const create = role.command("create").description("Create (idempotent by roleId) a single-clause role from --actions.").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id (3-31 chars; lowercase letter + lowercase/digit/dash)").requiredOption("--name <name>", "human-readable name").requiredOption("--actions <csv>", "allowed actions, comma-separated (e.g. records:cru,search:r)").option(
@@ -20324,7 +21737,7 @@ function registerRoleCommands(program, deps) {
 }
 function registerAccessCommands(program, deps) {
   const access2 = program.command("access").description("Manage access bindings: principal \u2194 context \u2194 role/scopes.");
-  const grant = access2.command("grant").description("Bind a principal to a context via a role or inline actions.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--role <roleId>", "reference a Role (XOR --actions)").option("--actions <csv>", "inline single-clause actions, comma-separated (XOR --role)").option("--scope <ns:value>", "identity override: a scope the principal acts under (repeatable, e.g. org:<id>)", collect, []).option("--identity-overrides <json>", "general identity overrides as a JSON object (merged over --scope)");
+  const grant = access2.command("grant").description("Bind a principal to a context via a role or inline actions.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--role <roleId>", "reference a Role (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions, comma-separated (XOR --role)").option("--scope <ns:value>", "identity override: a scope the principal acts under (repeatable, e.g. org:<id>)", collect, []).option("--identity-overrides <json>", "general identity overrides as a JSON object (merged over --scope)");
   addCommonAuthOptions(grant).action(
     async (flags) => {
       process.exit(
@@ -20405,6 +21818,25 @@ function registerIdentityCommands(program, deps) {
   addAuthOptions(del).action(async (flags) => {
     process.exit(await runIdentityDelete({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps));
   });
+  const invite = identity.command("invite").description("Onboard a person into a context by email (POST /v1/users/invite) \u2014 no root key required.").requiredOption("--context <contextId>", "the app context the invitee will operate in").requiredOption("--role <roleId>", "an existing Role in that context; the invitee inherits its scopes").requiredOption("--email <email>", "the invitee's email address").option("--first-name <name>", "personalizes the invitation email greeting").option("--accept-url <url>", "your accept-invite landing page (required unless --no-send-email)").option("--no-send-email", "skip platform delivery; the response carries the raw inviteToken/acceptLink instead");
+  addCommonAuthOptions(invite).action(
+    async (flags) => {
+      process.exit(
+        await runIdentityInvite(
+          {
+            ...toCommonOptions(flags),
+            context: flags.context,
+            role: flags.role,
+            email: flags.email,
+            firstName: flags.firstName,
+            acceptUrl: flags.acceptUrl,
+            noSendEmail: flags.sendEmail === false
+          },
+          deps
+        )
+      );
+    }
+  );
 }
 function addKeyDestinationOptions(cmd) {
   return cmd.addOption(new import_commander.Option("--format <fmt>", "how to emit the secret").choices(KEY_FORMATS).default("human")).option(
@@ -20423,9 +21855,10 @@ function toKeyDestination(flags) {
 function registerKeyCommands(program, deps) {
   const key = program.command("key").description("Manage scoped API keys (ssk_*) \u2014 issue, list, revoke, rotate.");
   const issue = addKeyDestinationOptions(
-    key.command("issue").description("Mint an ssk_* for a principal that already has a profile in the context.").requiredOption("--principal <p>", "principal (usr_<id> or <id>) with an AccessProfile in the context").requiredOption("--context <c>", "app context the key operates in").option("--name <name>", "key name (idempotency tuple component)", DEFAULT_KEY_NAME).option("--label <label>", "optional principal label (surfaced in /v1/ping)")
+    key.command("issue").description("Mint an ssk_* for a principal that already has a profile in the context.").requiredOption("--principal <p>", "principal (usr_<id> or <id>) with an AccessProfile in the context").requiredOption("--context <c>", "app context the key operates in").option("--name <name>", "key name (idempotency tuple component)", DEFAULT_KEY_NAME).option("--label <label>", "optional principal label (surfaced in /v1/ping)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)")
   );
   addAuthOptions(issue).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
     process.exit(
       await runKeyIssue({
         ...toCommonOptions(flags),
@@ -20433,6 +21866,7 @@ function registerKeyCommands(program, deps) {
         context: flags.context,
         name: flags.name,
         label: flags.label,
+        tenant,
         ...toKeyDestination(flags)
       }, deps)
     );
@@ -20440,37 +21874,50 @@ function registerKeyCommands(program, deps) {
   const list = key.command("list").description("List active scoped keys in one context (default, or --context <id>); --all-contexts for every context.").option("--principal <p>", "only keys for this principal (usr_<id> or <id>)").option("--context <c>", "only keys in this context (default: the default context)").option(
     "--all-contexts",
     "list every key across ALL your contexts (owner-only) \u2014 the tenant-wide view for the key limit"
-  );
+  ).option("--tenant <tenant>", "tenant to list: 'test' or 'live' (default live; not combinable with --all-contexts)");
   addCommonAuthOptions(list).action(
     async (flags) => {
+      if (flags.allContexts && flags.tenant !== void 0) {
+        process.stderr.write("  \u2716 --tenant is not combinable with --all-contexts (which already spans both tenants).\n");
+        process.exit(2);
+      }
+      const tenant = parseTenantFlag(flags.tenant);
       process.exit(
         await runKeyList(
           {
             ...toCommonOptions(flags),
             principal: flags.principal,
             context: flags.context,
-            allContexts: Boolean(flags.allContexts)
+            allContexts: Boolean(flags.allContexts),
+            tenant
           },
           deps
         )
       );
     }
   );
-  const get = key.command("get").description("Show one key\u2019s metadata (no secret).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)");
-  addCommonAuthOptions(get).action(async (keyId, flags) => {
-    process.exit(await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context }, deps));
-  });
-  const revoke = key.command("revoke").description("Revoke a key (soft-delete; ~5 min to take effect).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)");
-  addAuthOptions(revoke).action(async (keyId, flags) => {
-    process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context }, deps));
-  });
+  const get = key.command("get").description("Show one key\u2019s metadata (no secret).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(get).action(
+    async (keyId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+    }
+  );
+  const revoke = key.command("revoke").description("Revoke a key (soft-delete; ~5 min to take effect).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)");
+  addAuthOptions(revoke).action(
+    async (keyId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+    }
+  );
   const rotate = addKeyDestinationOptions(
     key.command("rotate").description("Revoke the matching active key and mint a fresh secret.").requiredOption("--principal <p>", "principal (usr_<id> or <id>)").requiredOption("--context <c>", "app context").option("--name <name>", "key name to rotate", DEFAULT_KEY_NAME).option(
       "--force-new",
       "mint a new key even though other active keys already exist for this principal/context under a different name (bypasses the default-name-mismatch guard)"
-    )
+    ).option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)")
   );
   addAuthOptions(rotate).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
     process.exit(
       await runKeyRotate({
         ...toCommonOptions(flags),
@@ -20478,6 +21925,7 @@ function registerKeyCommands(program, deps) {
         context: flags.context,
         name: flags.name,
         forceNew: flags.forceNew,
+        tenant,
         ...toKeyDestination(flags)
       }, deps)
     );