@vectros-ai/cli 0.16.0 → 0.19.0

package/dist/cli.js

@@ -4103,7 +4103,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/admin/keys/scoped");
   }
   /**
-   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. A root API key (`sk_`) is exempt from both bounds.
+   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. Minting a key bound to your OWN principal needs nothing further; minting one bound to a DIFFERENT principal additionally requires the `delegate-mint` capability (`granted_capabilities`) on your credential — without it the request is refused. A root API key (`sk_`) is exempt from all three bounds.
    *
    * @param {Vectros.CreateScopedKeyRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5599,7 +5599,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/usage");
   }
   /**
-   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key sees every context.
+   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key sees every context. An ordinary bootstrap credential that didn't specify a context resolves to the `default` app context specifically, not every context — so this call returns 404 for an issuer registered under any other context unless you re-minted the bootstrap token pinned to that context.
    *
    * @param {Vectros.GetIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5656,6 +5656,73 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
+  /**
+   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `status` (`active`/`suspended` — a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
+   *
+   * @param {Vectros.IssuerUpdateRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.updateIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  updateIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateIssuer(request, requestOptions));
+  }
+  async __updateIssuer(request, requestOptions) {
+    const { issuerId, ..._body } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "PUT",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: _body,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/auth/issuers/{issuerId}");
+  }
   /**
    * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. Deactivate the affected users first if you intend to cut off their access, or register a replacement issuer before removing this one. An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
    *
@@ -5726,7 +5793,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only the issuers registered in that context; a root API key sees every context. Returns a `{data, nextCursor}` envelope.
+   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only the issuers registered in that context; a root API key sees every context. An ordinary bootstrap credential that didn't specify a context resolves to the `default` app context specifically, not every context — so this call returns an empty page for a tenant whose issuers are all registered under a different context unless you re-minted the bootstrap token pinned to that context. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListIssuersRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5783,7 +5850,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
   }
   /**
-   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`.
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`.
    *
    * @param {Vectros.IssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5968,6 +6035,7 @@ var AuthClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -6021,6 +6089,8 @@ var AuthClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -6034,7 +6104,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token");
   }
   /**
-   * Invite a new member to one of your app contexts by email. Creates a pending user with a pre-resolved access profile (their permissions on accept) and signs an invitation token. This call is idempotent on the combination of context and email: re-inviting the same email in the same context rotates the token and resends the invitation rather than creating a duplicate — this requires the `users:r` and `users:u` scopes in addition to `users:c`, because resending rotates a credential on an existing invitation and invalidates any link already sent. Without them the collision returns 409 instead, with no invitation details and no change to the outstanding invitation. Returns HTTP 201 on a new invite or a successful resend. Returns 409 if that email already belongs to an active or suspended member of the app context, or already has an identity elsewhere in your account (an email can currently belong to only one tenant per account, i.e. your test and live environments cannot share an email). When `sendEmail` is false, the response includes the raw token and a ready-to-use accept link so you can deliver the invitation through your own email provider. Requires the `users:c` scope.
+   * Invite a new member to one of your app contexts by email, OR grant an existing member access to an additional app context by inviting their same email again. Idempotent on the combination of context and email: re-inviting the same email into the SAME context rotates the token and resends the invitation rather than creating a duplicate — this requires the `users:r` and `users:u` scopes in addition to `users:c`, because resending rotates a credential on an existing invitation and invalidates any link already sent. Without them the collision returns 409 instead, with no invitation details and no change to the outstanding invitation. Inviting the SAME email into a DIFFERENT app context in this tenant, where that email already resolves to an existing member: if that member is active AND already has (or, once accepted, will have) a credential that works for the new context's own identity provider, this immediately grants them access to the new context (no email is sent — there is nothing to accept, `emailSent` is false) — this additionally requires the `users:r` scope (no `users:u`, since nothing is mutated), because the response names the existing member's userId, a fact about them your credential could not otherwise learn through this endpoint. If that active member's ONLY existing credential is for a DIFFERENT identity provider than the one the new context uses, a normal, independent invitation is created instead (its own new member id, a real token/accept link) — attaching them silently would leave no way for them to ever actually sign in to that context. If the existing member's original invitation is still pending, this attaches the new context's access to that same outstanding invitation and rotates its token (`users:r`+`users:u`, same as an ordinary resend — both the disclosure and the credential rotation apply here). A SUSPENDED member's email does not get new-context access this way — reactivate them explicitly first. Returns HTTP 201 in every one of those cases. Returns 409 if that email already belongs to an active or suspended member of THIS specific app context, already has a PENDING invitation for THIS specific app context, or resolves to an existing member elsewhere in the tenant and your token lacks the additional scope the grant/attach requires (`users:r`, or `users:r`+`users:u` for the still-pending case). An email that already has an identity in your OTHER tenant (test vs. live) is not a collision either — it creates an additional, independent membership in this tenant for that same identity. When `sendEmail` is false, the response includes the raw token and a ready-to-use accept link so you can deliver the invitation through your own email provider. Requires the `users:c` scope.
    *
    * @param {Vectros.CreateInviteRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6172,6 +6242,83 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/invite/resend");
   }
+  /**
+   * Re-mints the presented `st_*` scoped token with one or more `identity.<namespace>` values changed — for a caller whose ROLE explicitly grants assuming those values (an invited hr-admin, a multi-org case-handler) and needs to change which value new writes place records under. The request body names one or more namespaces in canonical `scope:<namespace>` form, e.g. `{"scope:org": "orgB"}` — each value must be a plain literal, never a `${{ ... }}` placeholder. When you name MORE THAN ONE namespace, a single one of your roles must grant all of them together: the combination is never assembled from two different roles, because no role author would have vouched for it. `st_*`-only — a root API key or `ssk_*` scoped API key gets 403; neither needs this (root already has full authority, and an `ssk_*`'s identity shape is not what this resolves against).
+   *
+   * **Only an original token may assume.** A token produced BY this endpoint cannot assume again (403) — every assume starts from the token you exchanged for, so the identity you end up with is always one a single role explicitly granted rather than a combination reached by chaining calls. Keep your original token if you need to switch more than once, or exchange for a new one.
+   *
+   * **Entitlement is checked LIVE, against your roles as they are right now** — not against a copy frozen into your token when it was minted. The requested value must be explicitly granted by a role's `assumable` field for that namespace: a POINT check against the one value requested, and a deliberately separate, explicitly-authored question from what the role's `data_scope` permits reading or writing. Holding broad `data_scope` reach in a namespace does NOT by itself grant assuming any value in it.
+   *
+   * **What is preserved, and what is not.** Every clause of your token that does not reference a requested namespace is preserved verbatim, as are all other claims (`partner_user_id`, `context_id`, mint attribution). Clauses that DO reference a requested namespace are kept only if they come from a role that authorized the new value. A role that does not authorize it loses all of its clauses touching that namespace — including any scoped to the value you already held. Assume into a value one role grants and you keep that role's reach, not the reach of roles that never vouched for it.
+   *
+   * The re-minted token's `exp` is IDENTICAL to the presented token's — this call can never extend a session's life. A fresh, independently-revocable `jti` is stamped on every call, and (except when the presented token predates jti support and has none to chain from) the token also carries a `root_jti` revocation-lineage claim so revoking the token you started from closes every value ever assumed from it. Uses the ordinary Vectros `{"message":...}` error shape, not the OAuth envelope `POST /v1/auth/token/exchange` uses — this endpoint's caller is always Vectros-SDK code already holding a bearer token, never generic OAuth tooling.
+   *
+   * @param {Record<string, unknown>} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.UnauthorizedError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.ConflictError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.assumeToken({
+   *         "scope:org": "orgB"
+   *     })
+   */
+  assumeToken(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__assumeToken(request, requestOptions));
+  }
+  async __assumeToken(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/token/assume"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 401:
+          throw new UnauthorizedError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token/assume");
+  }
   /**
    * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. If your issuer is registered against more than one app context (each via its own audience), `context_id` selects which one to target; omit it when your token's `aud` claim matches only one registered context — the common case, unaffected by this field. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
    *
@@ -6249,9 +6396,9 @@ var ComplianceClient = class {
    * @param {Vectros.ErasureRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.TooManyRequestsError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.compliance.createErasureRequest({
@@ -6290,12 +6437,12 @@ var ComplianceClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -6314,7 +6461,6 @@ var ComplianceClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.compliance.getErasureRequest({
@@ -6355,8 +6501,6 @@ var ComplianceClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -8196,7 +8340,7 @@ var IdentityClient = class {
     );
   }
   /**
-   * Retrieves a single scope-namespace registration by name. The reserved built-ins `org` and `client` are always resolvable.
+   * Retrieves a single scope-namespace registration by name.
    *
    * @param {Vectros.GetNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8389,7 +8533,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/namespaces/{namespace}");
   }
   /**
-   * Returns the scope namespaces in your account, including `org` and `client`, which are provisioned for you when the account is created. Returns a `{data, nextCursor}` envelope.
+   * Returns the scope namespaces registered in your account. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListNamespacesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8440,7 +8584,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces");
   }
   /**
-   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. `org` and `client` are provisioned when your account is created, so registering either returns the already-registered error.
+   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary partner-grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and `contextId` is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). `org` and `client` are reserved names, registered the same way as any other namespace.
    *
    * @param {Vectros.RegisterNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8510,7 +8654,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/namespaces");
   }
   /**
-   * Returns a paginated list of the users in your account. Pass `externalId` to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply `type` and `field` together with one lookup mode: `value` (exact match), `from`+`to` (range), or `prefix`. Requires the `users:r` scope.
+   * Returns a paginated list of the users in your account. Pass `externalId` to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply `type` and `field` together with one lookup mode: `value` (exact match), `from`+`to` (range), or `prefix`. Requires the `users:r` scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.
    *
    * @param {Vectros.ListUsersRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8575,7 +8719,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users");
   }
   /**
-   * Creates a user identity in your account. The operation is idempotent on `externalId`: if a user with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set `?upsert=true` (this also requires the `users:u` scope). Requires the `users:c` scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the `users:r` scope — a credential holding `users:c` alone receives a `400` ("already exists") on collision instead of the user.
+   * Creates a user identity in your account. The operation is idempotent on `externalId`: if a user with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set `?upsert=true` (this also requires the `users:u` scope). Requires the `users:c` scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the `users:r` scope — a credential holding `users:c` alone receives a `400` ("already exists") on collision instead of the user. A context-confined credential additionally receives the collision echo (or, with `?upsert=true`, is allowed to overwrite) only when the colliding user holds an access profile in the credential's own app context — a cross-context collision otherwise gets the same uniform `400` instead of the other context's user data. One narrow exception on the plain (non-upsert) echo only: the CLI's no-code bootstrap credential can be echoed a colliding user across app contexts, needed for a blueprint to idempotently re-apply against a service principal it provisioned in a non-default context; this does not extend to `?upsert=true`.
    *
    * @param {Vectros.CreateUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8699,7 +8843,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/{id}");
   }
   /**
-   * Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The `type` field is immutable after creation, and `email` cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries `inviteToken`, `externalSubject`, and `emailVerifiedAttestation=true` completes the invitation. Requires the `users:u` scope.
+   * Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The `type` field is immutable after creation, and `email` cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries `inviteToken`, `externalSubject`, and `emailVerifiedAttestation=true` completes the invitation. **`externalSubject` set this way is NOT an authentication binding and does not enable sign-in anywhere** — not the Vectros DevPortal/Admin App/web apps, and not `/v1/auth/token/exchange` either; both are granted only by the invitee authenticating themselves. If the invitee needs dev-portal/web-app access, send them the invitation link and let them accept it directly. If the invitee needs to sign in via token exchange, have them redeem `inviteToken` themselves at `/v1/auth/token/exchange` with their own credential — Vectros verifies it there and computes its own value for this field from the verified credential. The value you send here is stored exactly as-is, with no normalization, and does NOT automatically match or deduplicate against what a later token-exchange sign-in computes for the same real-world identity. Call this endpoint directly only if you run your own backend and want Vectros to record which of your own users a given account corresponds to — treat this field as informational for that purpose, not as a way to pre-authorize sign-in. Requires the `users:u` scope.
    *
    * @param {Vectros.UpdateUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8766,7 +8910,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/users/{id}");
   }
   /**
-   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner.
+   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner. Called by a context-confined credential, deletion is also refused (409) when the user holds access in an app context other than the caller's own — remove the user from the caller's own context first, or use a credential with cross-context reach.
    *
    * @param {Vectros.DeleteUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8827,7 +8971,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/users/{id}");
   }
   /**
-   * Looks up users by a schema lookup field, with the query criteria carried in the request body rather than the URL. Use this when looking up by a sensitive (blind-indexed) field: the value is blind-indexed server-side and never appears in the URL, request logs, or proxies. The query semantics are identical to the GET /v1/users lookup, which rejects sensitive-field values and directs you here. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
+   * Looks up users by a schema lookup field, with the query criteria carried in the request body rather than the URL. Use this when looking up by a sensitive (blind-indexed) field: the value is blind-indexed server-side and never appears in the URL, request logs, or proxies. The query semantics are identical to the GET /v1/users lookup, which rejects sensitive-field values and directs you here. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.
    *
    * @param {Vectros.IdentityLookupRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -9270,14 +9414,14 @@ var RecordsClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Reserved endpoint for fetching multiple records by ID in one call. When available, the response will contain only the records you can see; any IDs that do not exist or are outside your scope are silently omitted (there is no per-ID existence signal), matching the not-found behavior of the single-record GET. It currently returns 501 (not implemented). The documented 200 response schema is the stable shape this endpoint will use once available. Requires the `records:r` scope.
+   * Fetches multiple records by ID in one call (`ids`, maximum 100). The response contains only the records you can access — any id that does not exist, belongs to another account/AppContext, or is outside your token's scope is silently omitted, with no per-id existence signal, matching the not-found behavior of the single-record GET. Payloads are hydrated the same way a by-id GET hydrates them (payloads externalized to object storage are rehydrated for this response). Requires the `records:r` scope (and, for a scoped token, `records:r:<type>` per record type).
    *
    * @param {Vectros.BatchGetRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.TooManyRequestsError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.records.batchGetRecords()
@@ -9314,12 +9458,12 @@ var RecordsClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -10133,7 +10277,7 @@ var SchemasClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `scope` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by an identity surface (`user` or `entity`) lists your account-wide identity schemas regardless of the calling context; filtering by record or document lists within the calling context. Requires the `schemas:r` scope.
+   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `scope` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by `surface=user` lists your account-wide identity schemas regardless of the calling context (a `user`-surfaced schema always has one tenant-wide home). Filtering by `surface=entity` reads your own app context's entity schemas AND the tenant-wide home together, newest first, through a single cursor — an entity schema may live in either home depending on where its namespace is placed (see `POST /v1/namespaces`). Filtering by `record` or `document` lists within the calling context only. Requires the `schemas:r` scope.
    *
    * @param {Vectros.ListSchemasRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10421,6 +10565,7 @@ var SchemasClient = class {
    * @param {Vectros.DeleteSchemaRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
@@ -10460,6 +10605,8 @@ var SchemasClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 409:
@@ -10928,7 +11075,26 @@ var GrantedCapabilitiesSchema = import_zod.z.array(import_zod.z.string().min(1))
 var BlueprintAccessProfileSchema = import_zod.z.object({
   // Validated structurally here; the SCOPE GATE (in @vectros-ai/cli) is
   // what enforces the data-plane-only security boundary.
-  allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1),
+  //
+  // Optional now: mutually exclusive with `roleIds` below (the
+  // `.superRefine` on this schema enforces the XOR, mirroring the platform's
+  // own `AccessProfileDB.validateScopesXorRole`). Exactly one of the two
+  // authors this profile's grant.
+  allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1).optional(),
+  // Additive role composition: this profile's effective grant is
+  // each named role's own clauses, concatenated in the order listed, instead of
+  // an inline clause authored here. Every id must name a role this SAME
+  // blueprint declares in `roles` (`lintAccessProfileRoleIds` below — the
+  // authoring-time mirror of the platform's same-`(tenantId, contextId)`
+  // check, trivially satisfied here since a blueprint's own `roles` are
+  // always created in its own `contextId`); duplicates are rejected outright
+  // rather than silently deduplicated. Mutually exclusive
+  // with `allowedActions`/`dataScope`/`capabilities` — a role-referencing
+  // profile has no inline clause of its own to carry a dataScope or
+  // capability grant; author those on the referenced Role instead, where
+  // every profile referencing it picks them up uniformly (mirrors how
+  // `assumable` already works for a `roleId`-referencing profile).
+  roleIds: import_zod.z.array(import_zod.z.string().min(1)).min(1).optional(),
   // Optional ownership binding: { userId: [...], "scope:org": [...], "scope:client": [...] }.
   // A `null` element in a value list is the documented NULL SENTINEL — it
   // grants access to TENANT-LEVEL (owner-less) records IN ADDITION to the
@@ -10976,13 +11142,54 @@ var BlueprintAccessProfileSchema = import_zod.z.object({
   // a person is bound to. The gate should weigh the two separately rather
   // than reuse one policy for both.
   capabilities: GrantedCapabilitiesSchema
-}).strict();
+}).strict().superRefine((ap, ctx) => {
+  const hasInline = ap.allowedActions !== void 0;
+  const hasRoleIds = ap.roleIds !== void 0;
+  if (hasInline === hasRoleIds) {
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      path: ["roleIds"],
+      message: hasInline ? "accessProfile carries both 'allowedActions' and 'roleIds' \u2014 provide exactly one: an inline clause (allowedActions, optionally dataScope/capabilities) OR a role composition (roleIds), never both" : "accessProfile carries neither 'allowedActions' nor 'roleIds' \u2014 provide exactly one: an inline clause (allowedActions, optionally dataScope/capabilities) OR a role composition (roleIds)"
+    });
+    return;
+  }
+  if (hasRoleIds) {
+    if (ap.dataScope !== void 0) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: ["dataScope"],
+        message: "accessProfile.dataScope is not valid alongside 'roleIds' \u2014 a role-composed profile has no inline clause of its own; author dataScope on the referenced role's clause instead"
+      });
+    }
+    if (ap.capabilities !== void 0) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: ["capabilities"],
+        message: "accessProfile.capabilities is not valid alongside 'roleIds' \u2014 a role-composed profile has no inline clause of its own; author capabilities on the referenced role's clause instead"
+      });
+    }
+  }
+});
 var BlueprintRoleClauseSchema = import_zod.z.object({
   allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1),
   dataScope: import_zod.z.record(import_zod.z.array(import_zod.z.union([import_zod.z.string().min(1), import_zod.z.null()]))).optional(),
+  dataScopeRef: import_zod.z.string().min(1).optional(),
   capabilities: GrantedCapabilitiesSchema
-}).strict();
+}).strict().superRefine((c, ctx) => {
+  if (c.dataScope !== void 0 && c.dataScopeRef !== void 0) {
+    ctx.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      path: ["dataScopeRef"],
+      message: "a clause may declare 'dataScope' OR 'dataScopeRef', not both \u2014 dataScopeRef is sugar for an inline dataScope fragment, so the two are alternatives for the same slot, not additive"
+    });
+  }
+});
+var BlueprintFragmentsSchema = import_zod.z.record(
+  import_zod.z.record(import_zod.z.array(import_zod.z.union([import_zod.z.string().min(1), import_zod.z.null()])))
+);
 var BlueprintRolesSchema = import_zod.z.record(import_zod.z.array(BlueprintRoleClauseSchema).min(1));
+var BlueprintRoleAssumableSchema = import_zod.z.record(import_zod.z.array(import_zod.z.string().min(1)).min(1));
+var BlueprintRoleAssumableMapSchema = import_zod.z.record(BlueprintRoleAssumableSchema);
 var IDENTITY_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
 var FORBIDDEN_IDENTITY_NAMESPACES = /* @__PURE__ */ new Set(["record", "document", "entity", "user"]);
 var IdentityKindSchema = import_zod.z.string().min(1).superRefine((val, ctx) => {
@@ -11046,6 +11253,14 @@ var BlueprintIssuerSchema = import_zod.z.object({
   subClaim: import_zod.z.string().min(1).optional(),
   /** The claim carrying the subject's email (first-login invite matching). Platform defaults to 'email' when omitted. */
   emailClaim: import_zod.z.string().min(1).optional(),
+  /**
+   * The IdP's OIDC userinfo endpoint. Optional. Presented tokens are access tokens, which under
+   * OIDC don't carry `email` unless the IdP was specifically configured to add it — if
+   * `emailClaim` misses on the presented token, and `userinfoUri` is configured, Vectros falls
+   * back to calling this endpoint (with the presented token as the bearer credential) and reads
+   * `emailClaim` from its JSON response instead. Omit to leave the fallback disabled.
+   */
+  userinfoUri: import_zod.z.string().min(1).optional(),
   /**
    * Opt-in self-service signup: a list of {signupType, roleId} pairs. When a first-time exchange
    * caller presents no invite token but names a signupType matching one of these (or omits it and
@@ -11075,6 +11290,24 @@ var BlueprintNamespaceSchema = import_zod.z.object({
    * free-form strings validated by grammar only.
    */
   entityBacked: import_zod.z.boolean().optional(),
+  /**
+   * Request the platform's TENANT-WIDE registration form instead of this
+   * blueprint's own context — visible to every context in the account, not
+   * just the one this blueprint provisions. `false`/omitted (the default)
+   * is the ordinary, context-owned registration every other namespace here
+   * gets. Mutually exclusive with any future context-targeting field this
+   * schema may grow — there is exactly one way to say "not my own context"
+   * today.
+   *
+   * A blueprint declaring this does NOT get it automatically: the applying
+   * credential must separately hold a platform capability granted only to
+   * an account OWNER, and the CLI refuses to even request it unless
+   * explicitly told to (see `--allow-tenant-wide-namespaces`) — no flag,
+   * no request, regardless of what this field says. Setting this to `true`
+   * states the blueprint's INTENT; it is not, on its own, a grant of
+   * anything.
+   */
+  tenantWide: import_zod.z.boolean().optional(),
   /**
    * This namespace's position in your account's specificity order (used to
    * break a tie when a caller holds two scope dimensions at once). Required
@@ -11258,7 +11491,7 @@ function lintSelfTokenPlacement(value, ctx) {
         ctx.addIssue({
           code: import_zod.z.ZodIssueCode.custom,
           path: path4,
-          message: "'${{ self.* }}' / '${{ member.* }}' is a runtime placeholder \u2014 it is only valid inside a roles[].dataScope value"
+          message: "'${{ self.* }}' / '${{ member.* }}' is a runtime placeholder \u2014 it is only valid inside a roles[].dataScope value, a roleAssumable[] value, or a fragments[] value"
         });
       }
       return;
@@ -11269,7 +11502,10 @@ function lintSelfTokenPlacement(value, ctx) {
     }
     if (node && typeof node === "object") {
       for (const [k, v] of Object.entries(node)) {
-        const entering = inRoleDataScope || path4.length === 3 && path4[0] === "roles" && k === "dataScope";
+        const inRoleDataScopeClause = path4.length === 3 && path4[0] === "roles" && k === "dataScope";
+        const inRoleAssumable = path4.length === 0 && k === "roleAssumable";
+        const inFragments = path4.length === 0 && k === "fragments";
+        const entering = inRoleDataScope || inRoleDataScopeClause || inRoleAssumable || inFragments;
         walk(v, [...path4, k], entering);
       }
     }
@@ -11440,6 +11676,140 @@ function lintDataScopeKeys(value, ctx) {
       }
     });
   }
+  for (const [name, fragment] of Object.entries(bp.fragments ?? {})) {
+    for (const key of Object.keys(fragment ?? {})) {
+      lintDataScopeKey(key, ["fragments", name, key], ctx);
+    }
+  }
+}
+function lintDataScopeRefs(value, ctx) {
+  const bp = value;
+  const declared = new Set(Object.keys(bp.fragments ?? {}));
+  for (const [roleId, clauses] of Object.entries(bp.roles ?? {})) {
+    clauses.forEach((clause, i) => {
+      if (clause.dataScopeRef === void 0) return;
+      if (!declared.has(clause.dataScopeRef)) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: ["roles", roleId, i, "dataScopeRef"],
+          message: `dataScopeRef '${clause.dataScopeRef}' is not declared in fragments \u2014 declared fragments: ` + (declared.size ? [...declared].join(", ") : "(none)")
+        });
+      }
+    });
+  }
+}
+var BARE_SELF_PLACEHOLDER_RE = /^\$\{\{\s*self\.[^}]*?\s*\}\}$/;
+var UNDER_SELF_PLACEHOLDER_RE = /^\$\{\{\s*under\.self\.userId\s*\}\}$/;
+var UNDER_SELF_SCOPE_PLACEHOLDER_RE = /^\$\{\{\s*under\.self\.scope\.[a-z][a-z0-9_-]{1,31}\s*\}\}$/;
+var MEMBER_SCOPE_PLACEHOLDER_RE = /^\$\{\{\s*member\.scope\.[a-z][a-z0-9_-]{1,31}(?::[a-z][a-z0-9_-]{1,31})?\s*\}\}$/;
+var ANY_PLACEHOLDER_RE = /^\$\{\{\s*any\s*\}\}$/;
+function assumableValueError(publicKey, v) {
+  if (UNDER_SELF_PLACEHOLDER_RE.test(v) || MEMBER_SCOPE_PLACEHOLDER_RE.test(v)) return null;
+  if (UNDER_SELF_SCOPE_PLACEHOLDER_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' resolves against your own current value for that namespace, which an assume can itself change \u2014 so what this grant admits would depend on what was last assumed. Use '\${{ under.self.userId }}', '\${{ member.scope.<namespace>[:level] }}', or a plain literal, all of which mean the same thing before and after an assume. ('\${{ under.self.scope.<namespace> }}' remains valid in dataScope, where it is re-derived per write)`;
+  }
+  if (ANY_PLACEHOLDER_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' is not a concrete value and cannot be authored as an assumable grant \u2014 name the specific value(s) holders of this role may become`;
+  }
+  if (BARE_SELF_PLACEHOLDER_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' is the bare self placeholder, which is tautological here \u2014 it can only ever equal whatever identity currently is, never a distinct value to become. Use '\${{ under.self.userId }}', '\${{ member.scope.<namespace>[:level] }}', or a plain literal instead`;
+  }
+  if (SELF_TOKEN_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' is not a recognized runtime placeholder \u2014 use '\${{ under.self.userId }}' or '\${{ member.scope.<namespace>[:level] }}'`;
+  }
+  if (!SCOPE_VALUE_RE.test(v)) {
+    return `assumable['${publicKey}'] value '${v}' is not a valid scope value \u2014 1-128 characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'`;
+  }
+  return null;
+}
+function lintAccessProfileRoleIds(value, ctx) {
+  const bp = value;
+  const roleIds = bp.accessProfile?.roleIds;
+  if (!roleIds) return;
+  const declaredRoles = new Set(Object.keys(bp.roles ?? {}));
+  const seen = /* @__PURE__ */ new Set();
+  roleIds.forEach((roleId, i) => {
+    const path4 = ["accessProfile", "roleIds", i];
+    if (!declaredRoles.has(roleId)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: path4,
+        message: `accessProfile.roleIds names '${roleId}', which is not a role this blueprint declares in roles \u2014 ` + (declaredRoles.size ? `declared roles: ${[...declaredRoles].join(", ")}` : "declared roles: (none)")
+      });
+    }
+    if (seen.has(roleId)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: path4,
+        message: `accessProfile.roleIds names '${roleId}' more than once \u2014 remove the duplicate`
+      });
+    }
+    seen.add(roleId);
+  });
+}
+function lintRoleAssumable(value, ctx) {
+  const bp = value;
+  const declaredRoles = new Set(Object.keys(bp.roles ?? {}));
+  for (const [roleId, assumable] of Object.entries(bp.roleAssumable ?? {})) {
+    if (!declaredRoles.has(roleId)) {
+      ctx.addIssue({
+        code: import_zod.z.ZodIssueCode.custom,
+        path: ["roleAssumable", roleId],
+        message: `roleAssumable names '${roleId}', which is not a role this blueprint declares in roles \u2014 ` + (declaredRoles.size ? `declared roles: ${[...declaredRoles].join(", ")}` : "declared roles: (none)")
+      });
+      continue;
+    }
+    for (const [key, values] of Object.entries(assumable)) {
+      const path4 = ["roleAssumable", roleId, key];
+      if (key === "userId") {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: path4,
+          message: "assumable cannot name the principal ('userId') \u2014 the principal is never assumable via /assume, and a grant for it would save but could never be exercised"
+        });
+        continue;
+      }
+      const ns = key.startsWith("scope:") ? key.slice("scope:".length) : null;
+      const nsError = ns === null ? null : scopeNamespaceGrammarError(ns);
+      if (ns === null || nsError !== null) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: path4,
+          message: ns === null ? `'${key}' is not allowed \u2014 assumable keys must be a namespaced 'scope:<namespace>' key (the principal cannot be named)` : `assumable['${key}'] ${nsError}`
+        });
+        continue;
+      }
+      if (!Array.isArray(values)) continue;
+      values.forEach((v, i) => {
+        if (typeof v !== "string") return;
+        const err = assumableValueError(key, v);
+        if (err) ctx.addIssue({ code: import_zod.z.ZodIssueCode.custom, path: [...path4, i], message: err });
+      });
+    }
+  }
+}
+function expandDataScopeRefs(bp) {
+  if (!bp.roles) return bp;
+  const fragments = bp.fragments ?? {};
+  let changedAnyRole = false;
+  const roles = {};
+  for (const [roleId, clauses] of Object.entries(bp.roles)) {
+    let changedThisRole = false;
+    const expandedClauses = clauses.map((clause) => {
+      if (clause.dataScopeRef === void 0) return clause;
+      changedThisRole = true;
+      const { dataScopeRef, ...rest } = clause;
+      if (!(dataScopeRef in fragments)) {
+        throw new Error(
+          `expandDataScopeRefs: dataScopeRef '${dataScopeRef}' does not resolve against fragments \u2014 this should have been caught by lintDataScopeRefs before parseBlueprint reaches this function`
+        );
+      }
+      return { ...rest, dataScope: fragments[dataScopeRef] };
+    });
+    roles[roleId] = changedThisRole ? expandedClauses : clauses;
+    changedAnyRole = changedAnyRole || changedThisRole;
+  }
+  return changedAnyRole ? { ...bp, roles } : bp;
 }
 function lintSeedSurfaces(value, ctx) {
   const bp = value;
@@ -11510,6 +11880,24 @@ var BlueprintSchema = import_zod.z.object({
   seed: import_zod.z.array(BlueprintSeedRecordSchema).optional(),
   /** Optional multi-clause roles, bound to principals via `access grant --role`. */
   roles: BlueprintRolesSchema.optional(),
+  /**
+   * Optional roleId → `POST /v1/auth/token/assume`
+   * entitlement grant, mirroring the platform's role create/update request
+   * and response shape for this field. Kept separate from `roles` rather
+   * than folded into a role entry — see {@link BlueprintRoleAssumableMapSchema}'s
+   * own doc comment for why. Every key must name a role this blueprint
+   * declares in `roles` (`lintRoleAssumable`).
+   */
+  roleAssumable: BlueprintRoleAssumableMapSchema.optional(),
+  /**
+   * Optional named `dataScope` fragments, each
+   * referenceable from a role clause via `dataScopeRef: <name>` instead of
+   * repeating the same map inline. Purely local authoring sugar: not a
+   * provisioned resource (absent from `BLUEPRINT_FIELD_PHASES`), and never
+   * survives `parseBlueprint` as a live reference — see
+   * {@link expandDataScopeRefs}.
+   */
+  fragments: BlueprintFragmentsSchema.optional(),
   /** Optional principals ensured-exist at apply; referenced via ${{ identities.* }}. */
   identities: IdentitiesDeclSchema.optional(),
   /**
@@ -11534,6 +11922,9 @@ var BlueprintSchema = import_zod.z.object({
   lintIdentityOverrides(bp, ctx);
   lintNamespacedScopeArrays(bp, ctx);
   lintDataScopeKeys(bp, ctx);
+  lintDataScopeRefs(bp, ctx);
+  lintRoleAssumable(bp, ctx);
+  lintAccessProfileRoleIds(bp, ctx);
   lintSeedSurfaces(bp, ctx);
   lintIdentitySurfaces(bp, ctx);
   lintIssuerContext(bp, ctx);
@@ -11573,7 +11964,7 @@ function parseBlueprint(input) {
     throw new BlueprintValidationError(`Malformed blueprint:
 ${renderIssues(issues)}`, issues);
   }
-  return result.data;
+  return expandDataScopeRefs(result.data);
 }
 function contextNameOf(blueprint) {
   return blueprint.contextName ?? `MCP \u2014 ${blueprint.name}`;
@@ -11693,6 +12084,7 @@ var WHOLE_TOKEN_RE = /^\$\{\{\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*\}\}$/;
 var TOKEN_SCAN_RE = /\$\$\{\{|\$\{\{([\s\S]*?)\}\}|\$\{\{/g;
 var INNER_REF_RE = /^([A-Za-z_]\w*)\.([A-Za-z_]\w*)$/;
 var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under", "member"]);
+var DEFERRED_BARE_TOKENS = /* @__PURE__ */ new Set(["any"]);
 var DEFERRED_NS_ALTERNATION = [...DEFERRED_NAMESPACES].join("|");
 var DEFERRED_INNER_RE = new RegExp(
   `^(?:${DEFERRED_NS_ALTERNATION})(?:\\.[A-Za-z_]\\w*)+(?::[A-Za-z_]\\w*)?$`
@@ -11754,7 +12146,7 @@ function interpolate(str, ctx, path4) {
       });
     } else {
       const inner = (m[1] ?? "").trim();
-      if (DEFERRED_INNER_RE.test(inner)) {
+      if (DEFERRED_INNER_RE.test(inner) || DEFERRED_BARE_TOKENS.has(inner)) {
         out += m[0];
         last = TOKEN_SCAN_RE.lastIndex;
         continue;
@@ -14052,7 +14444,12 @@ async function resolveAuthContext(opts) {
   const baseUrl = envToBaseUrl(opts.env, opts.baseUrl ?? process.env.VECTROS_API_BASE_URL);
   const cognitoToken = await resolveCognitoToken(opts.env, opts.token);
   const tenant = opts.tenant ?? "live";
-  const bridge = opts.provisioning ? await mintBridgeToken({ cognitoToken, apiBaseUrl: baseUrl, tenant }) : await mintContextToken({ cognitoToken, apiBaseUrl: baseUrl, contextId: opts.context ?? "default", tenant });
+  const bridge = opts.provisioning ? await mintBridgeToken({
+    cognitoToken,
+    apiBaseUrl: baseUrl,
+    tenant,
+    ...opts.context ? { contextId: opts.context } : {}
+  }) : await mintContextToken({ cognitoToken, apiBaseUrl: baseUrl, contextId: opts.context ?? "default", tenant });
   const client = new VectrosClient({ token: bridge.token, environment: baseUrl });
   const identity = await resolveIdentity({ log: opts.log, apiKey: bridge.token, environment: baseUrl });
   return {
@@ -14194,6 +14591,9 @@ var SELF_QUALIFIED_OPS = /* @__PURE__ */ new Map([
 var UNQUALIFIABLE_WITH_ANY_TAIL = /* @__PURE__ */ new Map([
   ["profiles", /* @__PURE__ */ new Set(["r"])]
 ]);
+var CAPABILITY_UNLOCKED_OPS = /* @__PURE__ */ new Map([
+  ["profiles", /* @__PURE__ */ new Map([["c", "member-lifecycle"]])]
+]);
 var VALID_OPS = /* @__PURE__ */ new Set(["c", "r", "u", "d"]);
 var DATA_PLANE_SET = new Set(DATA_PLANE_ALLOWLIST);
 var CONTROL_PLANE_SET = new Set(KNOWN_CONTROL_PLANE_RESOURCES);
@@ -14263,7 +14663,7 @@ function firstInvalidOp(ops) {
   }
   return void 0;
 }
-function evaluateScopeToken(action) {
+function evaluateScopeToken(action, capabilities) {
   const token = action.trim();
   if (token.length === 0) {
     return { action, reason: "empty scope token" };
@@ -14314,9 +14714,12 @@ function evaluateScopeToken(action) {
         if (admittedOps?.has(ch)) continue;
         if (selfOnlyOps?.has(ch)) {
           if (isSelfQualified) continue;
+          const unlockCapability = CAPABILITY_UNLOCKED_OPS.get(resource)?.get(ch);
+          if (unlockCapability && qualifier === void 0 && capabilities?.includes(unlockCapability)) continue;
+          const capabilityHintApplies = unlockCapability && !capabilities?.includes(unlockCapability);
           return {
             action,
-            reason: `requests control-plane scope '${resource}:${ch}' without the required ':self' qualifier. A bare or arbitrarily-qualified '${resource}:${ch}' is outside the narrow allowlist (${admittedHint}) admitted for this resource \u2014 only '${resource}:${ch}:self' is. That operation must otherwise be done deliberately in the developer portal, never via the bootstrap loader`
+            reason: `requests control-plane scope '${resource}:${ch}' without the required ':self' qualifier. A bare or arbitrarily-qualified '${resource}:${ch}' is outside the narrow allowlist (${admittedHint}) admitted for this resource \u2014 only '${resource}:${ch}:self' is` + (capabilityHintApplies ? `, or this SAME clause also declaring 'capabilities: [${unlockCapability}]'` : unlockCapability ? ` (declaring 'capabilities: [${unlockCapability}]' does not help here \u2014 that capability only unlocks the BARE, unqualified form, never a literal-qualified one like this)` : "") + `. That operation must otherwise be done deliberately in the developer portal, never via the bootstrap loader`
           };
         }
         return {
@@ -14349,11 +14752,11 @@ function evaluateScopeToken(action) {
   }
   return null;
 }
-function evaluateScopeGate(allowedActions) {
+function evaluateScopeGate(allowedActions, capabilities) {
   const accepted = [];
   const rejected = [];
   for (const action of allowedActions) {
-    const rejection = evaluateScopeToken(action);
+    const rejection = evaluateScopeToken(action, capabilities);
     if (rejection) {
       rejected.push(rejection);
     } else {
@@ -14362,22 +14765,34 @@ function evaluateScopeGate(allowedActions) {
   }
   return { ok: rejected.length === 0, accepted, rejected };
 }
-function assertScopeGate(allowedActions) {
-  const result = evaluateScopeGate(allowedActions);
+function assertScopeGate(allowedActions, capabilities) {
+  const result = evaluateScopeGate(allowedActions, capabilities);
   if (!result.ok) {
     throw new ScopeGateError(result.rejected);
   }
 }
 function assertBlueprintGates(blueprint) {
-  assertScopeGate(blueprint.accessProfile.allowedActions);
-  assertCapabilityGate(blueprint.accessProfile.capabilities);
+  if (blueprint.accessProfile.allowedActions !== void 0) {
+    assertScopeGate(blueprint.accessProfile.allowedActions, blueprint.accessProfile.capabilities);
+    assertCapabilityGate(blueprint.accessProfile.capabilities);
+  }
   for (const clauses of Object.values(blueprint.roles ?? {})) {
     for (const clause of clauses) {
-      assertScopeGate(clause.allowedActions);
+      assertScopeGate(clause.allowedActions, clause.capabilities);
       assertCapabilityGate(clause.capabilities);
     }
   }
 }
+function effectiveAccessProfileActions(blueprint) {
+  if (blueprint.accessProfile.allowedActions !== void 0) {
+    return [...blueprint.accessProfile.allowedActions];
+  }
+  const out = [];
+  for (const roleId of blueprint.accessProfile.roleIds ?? []) {
+    for (const clause of blueprint.roles?.[roleId] ?? []) out.push(...clause.allowedActions);
+  }
+  return out;
+}
 
 // src/machine-id.ts
 var import_node_fs = require("fs");
@@ -14482,7 +14897,8 @@ async function resolveApplyTimeIdentities(blueprint, client, log) {
 function actionOf(created) {
   return created ? "created" : "reconciled";
 }
-async function registerNamespaceIdempotently(client, contextIdForRequest, decl) {
+async function registerNamespaceIdempotently(client, blueprintContextId, decl) {
+  const contextIdForRequest = decl.tenantWide ? void 0 : blueprintContextId;
   const body = {
     namespace: decl.namespace,
     entityBacked: decl.entityBacked,
@@ -14498,6 +14914,7 @@ async function registerNamespaceIdempotently(client, contextIdForRequest, decl)
   } catch (err) {
     const info = extractServerError(err);
     if (info.statusCode !== 400) throw err;
+    if (decl.tenantWide) throw err;
     let existing;
     try {
       existing = await client.getNamespace({ namespace: decl.namespace, contextId: contextIdForRequest });
@@ -14662,20 +15079,24 @@ function assertNoUnresolvedIdentities(blueprint) {
     );
   }
 }
-async function runLoader(client, input) {
-  const {
-    blueprint,
-    tenantId,
-    machineId,
-    rotate = false,
-    skipSeed = false,
-    readExistingKey,
-    persistMintedKey,
-    confirmExistingPrincipal,
-    log
-  } = input;
+var TenantWideNamespacesNotAllowedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TenantWideNamespacesNotAllowedError";
+  }
+};
+function assertTenantWideNamespacesAllowed(blueprint, allow) {
+  if (allow) return;
+  const names = (blueprint.namespaces ?? []).filter((ns) => ns.tenantWide === true).map((ns) => ns.namespace);
+  if (names.length === 0) return;
+  throw new TenantWideNamespacesNotAllowedError(
+    `Blueprint declares namespace${names.length > 1 ? "s" : ""} ${names.map((n) => `'${n}'`).join(", ")} as tenantWide: true \u2014 visible to every context in the account, not just this blueprint's own. Refusing to request that registration without an explicit opt-in. Re-run with --allow-tenant-wide-namespaces once you've confirmed that's actually intended (only an account OWNER's credential can complete it either way \u2014 this flag doesn't change who's allowed, only whether this run tries).`
+  );
+}
+async function provisionContext(client, input) {
+  const { blueprint, allowTenantWideNamespaces = false, readExistingKey, confirmExistingPrincipal, log } = input;
   assertBlueprintGates(blueprint);
-  assertNoUnresolvedIdentities(blueprint);
+  assertTenantWideNamespacesAllowed(blueprint, allowTenantWideNamespaces);
   const ctxResp = await client.auth.createAppContext({ body: { contextId: blueprint.contextId, name: contextNameOf(blueprint) } });
   const contextAction = actionOf(ctxResp.created);
   log.debug({ component: "loader", contextId: blueprint.contextId, contextAction }, "app-context ensured");
@@ -14714,10 +15135,10 @@ async function runLoader(client, input) {
       "existing-principal collision confirmed (or unwired) \u2014 proceeding with any further write to this principal"
     );
   }
-  const needsContextPinnedBootstrap = (blueprint.issuers ?? []).length > 0 || (blueprint.namespaces ?? []).length > 0;
+  const needsContextPinnedBootstrap = (blueprint.namespaces ?? []).length > 0;
   const ctxBootstrapClient = needsContextPinnedBootstrap ? input.remintBootstrapForContext ? await input.remintBootstrapForContext(blueprint.contextId) : client : void 0;
   if (ctxBootstrapClient && input.remintBootstrapForContext) {
-    log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted context-pinned bootstrap client");
+    log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted context-pinned bootstrap client (namespaces)");
   }
   const namespaceActions = [];
   for (const ns of blueprint.namespaces ?? []) {
@@ -14725,8 +15146,43 @@ async function runLoader(client, input) {
     namespaceActions.push({ namespace: ns.namespace, action });
     log.debug({ component: "loader", namespace: ns.namespace, contextId: blueprint.contextId, action }, "namespace ensured");
   }
+  return { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions, ctxBootstrapClient };
+}
+async function runLoader(client, input) {
+  const {
+    blueprint,
+    tenantId,
+    machineId,
+    rotate = false,
+    skipSeed = false,
+    allowTenantWideNamespaces = false,
+    readExistingKey,
+    persistMintedKey,
+    confirmExistingPrincipal,
+    log
+  } = input;
+  assertNoUnresolvedIdentities(blueprint);
+  const provisioned = input.provisioned ?? await provisionContext(client, {
+    blueprint,
+    allowTenantWideNamespaces,
+    remintBootstrapForContext: input.remintBootstrapForContext,
+    readExistingKey,
+    confirmExistingPrincipal,
+    log
+  });
+  const { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions } = provisioned;
+  assertBlueprintGates(blueprint);
+  const needsContextPinnedBootstrapForIssuers = (blueprint.issuers ?? []).length > 0;
+  const ctxBootstrapClient = provisioned.ctxBootstrapClient ?? (needsContextPinnedBootstrapForIssuers ? input.remintBootstrapForContext ? await input.remintBootstrapForContext(blueprint.contextId) : client : void 0);
+  if (ctxBootstrapClient && !provisioned.ctxBootstrapClient && input.remintBootstrapForContext) {
+    log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted context-pinned bootstrap client (issuers)");
+  }
   const issuerActions = [];
   for (const issuer of blueprint.issuers ?? []) {
+    const selfSignupPolicies = issuer.selfSignupPolicies?.map((p) => ({
+      signup_type: p.signupType,
+      role_id: p.roleId
+    }));
     const issuerResp = await ctxBootstrapClient.auth.registerIssuer({
       issuerId: issuer.issuerId,
       issuer: issuer.issuer,
@@ -14735,18 +15191,26 @@ async function runLoader(client, input) {
       contextId: issuer.contextId,
       subClaim: issuer.subClaim,
       emailClaim: issuer.emailClaim,
-      selfSignupPolicies: issuer.selfSignupPolicies?.map((p) => ({
-        signup_type: p.signupType,
-        role_id: p.roleId
-      }))
+      userinfoUri: issuer.userinfoUri,
+      selfSignupPolicies
     });
     const action = actionOf(issuerResp.created);
     issuerActions.push({ issuerId: issuer.issuerId, action });
     if (action === "reconciled") {
-      log.warn(
-        { component: "loader", issuerId: issuer.issuerId },
-        "issuer already registered \u2014 the platform has no update-issuer endpoint, so any edited fields (jwksUri, audience, subClaim, emailClaim, selfSignupPolicies) on this apply were NOT applied to the existing registration"
-      );
+      await ctxBootstrapClient.auth.updateIssuer({
+        issuerId: issuer.issuerId,
+        // Trust-anchor/routing-pin fields — echoed back, never actually
+        // changed here (the platform rejects a differing value).
+        issuer: issuer.issuer,
+        jwksUri: issuer.jwksUri,
+        audience: issuer.audience,
+        contextId: issuer.contextId,
+        subClaim: issuer.subClaim,
+        emailClaim: issuer.emailClaim,
+        userinfoUri: issuer.userinfoUri,
+        selfSignupPolicies
+      });
+      log.debug({ component: "loader", issuerId: issuer.issuerId }, "issuer already registered \u2014 reconciled safe fields to the declared values");
     } else {
       log.debug({ component: "loader", issuerId: issuer.issuerId, action }, "issuer registered");
     }
@@ -14786,10 +15250,35 @@ async function runLoader(client, input) {
     schemaActions.push({ typeName: s.typeName, action: actionOf(resp.created) });
     log.debug({ component: "loader", typeName: s.typeName, schemaId: resp.id, action: actionOf(resp.created) }, "schema ensured (upsert)");
   }
-  const profileBody = {
+  const roleIds = [];
+  const roleActions = [];
+  for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
+    const roleResp = await ctxClient.auth.createRole({
+      contextId: blueprint.contextId,
+      upsert: true,
+      body: {
+        roleId,
+        // Blueprint roles carry no display name → default it to the roleId.
+        name: roleId,
+        scopes: toRoleScopeClauses(clauses),
+        assumable: blueprint.roleAssumable?.[roleId]
+      }
+    });
+    roleIds.push(roleId);
+    roleActions.push({ roleId, action: actionOf(roleResp.created) });
+    log.debug({ component: "loader", roleId, clauses: clauses.length, action: actionOf(roleResp.created) }, "role ensured (upsert)");
+  }
+  const profileBody = blueprint.accessProfile.roleIds ? {
+    principalId: `usr_${userId}`,
+    roleIds: blueprint.accessProfile.roleIds,
+    identityOverrides: blueprint.accessProfile.identityOverrides
+  } : {
     principalId: `usr_${userId}`,
     scopes: [
       {
+        // Non-null: this is the `else` branch of the roleIds XOR above —
+        // `@vectros-ai/blueprints`' BlueprintAccessProfileSchema guarantees
+        // allowedActions is set whenever roleIds is not.
         allowed_actions: blueprint.accessProfile.allowedActions,
         // Pass dataScope straight through to the wire. The blueprint type is
         // Record<string, (string|null)[]> — a `null` element is the NULL
@@ -14823,22 +15312,6 @@ async function runLoader(client, input) {
     body: profileBody
   });
   log.debug({ component: "loader", principalId: `usr_${userId}`, accessProfileId: profile.id, profileAction }, "access profile ensured + reconciled to declared scopes");
-  const roleIds = [];
-  const roleActions = [];
-  for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
-    const roleResp = await ctxClient.auth.createRole({
-      contextId: blueprint.contextId,
-      body: {
-        roleId,
-        // Blueprint roles carry no display name → default it to the roleId.
-        name: roleId,
-        scopes: toRoleScopeClauses(clauses)
-      }
-    });
-    roleIds.push(roleId);
-    roleActions.push({ roleId, action: actionOf(roleResp.created) });
-    log.debug({ component: "loader", roleId, clauses: clauses.length, action: actionOf(roleResp.created) }, "role ensured");
-  }
   const keyName = keyNameFor(blueprint.name, machineId);
   let keyAction = "created";
   let revokedKeyId;
@@ -14949,6 +15422,11 @@ async function runLoader(client, input) {
     seedIndexFailures
   };
 }
+function renderPlanDataScope(ds) {
+  const entries = Object.entries(ds ?? {});
+  if (entries.length === 0) return "(none \u2014 unconstrained)";
+  return entries.map(([dim, values]) => `${dim}=[${values.map((v) => v === null ? "null" : v).join(", ")}]`).join(", ");
+}
 function buildPlan(blueprint, opts = {}) {
   const steps = [];
   steps.push({ kind: "context", summary: `context '${blueprint.contextId}' (${contextNameOf(blueprint)})` });
@@ -14957,7 +15435,7 @@ function buildPlan(blueprint, opts = {}) {
     summary: `principal '${blueprint.servicePrincipal.externalId}' (SERVICE)`
   });
   for (const ns of blueprint.namespaces ?? []) {
-    const ownerNote = `owned by '${blueprint.contextId}'`;
+    const ownerNote = ns.tenantWide ? "TENANT-WIDE \u2014 visible to every context" : `owned by '${blueprint.contextId}'`;
     const entityNote = ns.entityBacked ? ", entity-backed" : "";
     const membershipNote = ns.membershipRecordType ? `, membership: ${ns.membershipRecordType}.${ns.membershipTargetField}` + (ns.membershipLevelField ? ` (levels: ${ns.membershipLevels?.join("/")})` : "") : "";
     steps.push({
@@ -14985,20 +15463,40 @@ function buildPlan(blueprint, opts = {}) {
       summary: `schema '${s.typeName}' (${s.fields.length} field${s.fields.length === 1 ? "" : "s"}, ${indexNote})${lookupNote}${surfaceNote}${sensitiveNote}`
     });
   }
-  const actions = blueprint.accessProfile.allowedActions;
-  const scopeNote = blueprint.accessProfile.dataScope && Object.keys(blueprint.accessProfile.dataScope).length ? ` dataScope: ${Object.keys(blueprint.accessProfile.dataScope).join(", ")}` : "";
-  const capabilityNote = blueprint.accessProfile.capabilities?.length ? ` capabilities: [${blueprint.accessProfile.capabilities.join(", ")}]` : "";
-  steps.push({
-    kind: "profile",
-    summary: `profile scopes [${actions.join(", ")}] (data-plane \u2713)${scopeNote}${capabilityNote}`
-  });
   for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
     const actionSet = [...new Set(clauses.flatMap((c) => c.allowedActions))];
     const capSet = [...new Set(clauses.flatMap((c) => c.capabilities ?? []))];
     const roleCapabilityNote = capSet.length ? `, capabilities [${capSet.join(", ")}]` : "";
+    const clauseLines = clauses.map((c, i) => {
+      const capNote = c.capabilities?.length ? `, capabilities [${c.capabilities.join(", ")}]` : "";
+      return `      clause ${i + 1}: actions [${c.allowedActions.join(", ")}], dataScope: ${renderPlanDataScope(c.dataScope)}${capNote}`;
+    });
+    const assumable = blueprint.roleAssumable?.[roleId];
+    const assumableLine = assumable ? `
+      assumable: ${renderPlanDataScope(assumable)}` : "";
     steps.push({
       kind: "role",
-      summary: `role '${roleId}' (${clauses.length} clause${clauses.length === 1 ? "" : "s"}, actions [${actionSet.join(", ")}]${roleCapabilityNote})`
+      summary: `role '${roleId}' (${clauses.length} clause${clauses.length === 1 ? "" : "s"}, actions [${actionSet.join(", ")}]${roleCapabilityNote})
+` + clauseLines.join("\n") + assumableLine
+    });
+  }
+  const roleIdsNote = blueprint.accessProfile.roleIds;
+  if (roleIdsNote) {
+    steps.push({
+      kind: "profile",
+      summary: `profile via role(s) [${roleIdsNote.join(", ")}] (composed \u2014 each role's own clauses, concatenated in order)`
+    });
+  } else {
+    const actions = blueprint.accessProfile.allowedActions ?? [];
+    const scopeNote = blueprint.accessProfile.dataScope && Object.keys(blueprint.accessProfile.dataScope).length ? ` dataScope: ${Object.keys(blueprint.accessProfile.dataScope).join(", ")}` : "";
+    const capabilityNote = blueprint.accessProfile.capabilities?.length ? ` capabilities: [${blueprint.accessProfile.capabilities.join(", ")}]` : "";
+    const allDataPlane = !actions.some(
+      (a) => KNOWN_CONTROL_PLANE_RESOURCES.includes(a.split(":", 1)[0])
+    );
+    const planeNote = allDataPlane ? " (data-plane \u2713)" : " (includes a control-plane exception)";
+    steps.push({
+      kind: "profile",
+      summary: `profile scopes [${actions.join(", ")}]${planeNote}${scopeNote}${capabilityNote}`
     });
   }
   steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
@@ -15021,8 +15519,10 @@ function renderPlan(blueprint, steps) {
   ];
   if (steps.some((s) => s.kind === "issuer")) {
     legendLines.push(
-      `  Exception: issuers cannot be updated once registered \u2014 an existing`,
-      `  issuer is left unchanged, not reconciled to match.`
+      `  Exception: an issuer's trust-anchor fields (issuer, jwksUri, audience,`,
+      `  contextId) are immutable once registered \u2014 only subClaim/emailClaim/`,
+      `  userinfoUri/selfSignupPolicies actually reconcile on a re-apply (status is not`,
+      `  authorable in a blueprint at all).`
     );
   }
   if (steps.some((s) => s.kind === "namespace")) {
@@ -15031,6 +15531,12 @@ function renderPlan(blueprint, steps) {
       `  an existing registration converges silently, but one that disagrees FAILS`,
       `  the apply rather than reconciling it.`
     );
+    if (steps.some((s) => s.kind === "namespace" && /TENANT-WIDE/.test(s.summary))) {
+      legendLines.push(
+        `  Stricter still for a TENANT-WIDE namespace: it never converges, even on an`,
+        `  exact match \u2014 any existing registration of that name fails the apply.`
+      );
+    }
   }
   const legend = legendLines.join("\n");
   const lines = steps.map((s) => `    + ${s.summary}`);
@@ -17094,6 +17600,7 @@ function parseBootstrapArgs(argv) {
     useScopedToken: false,
     blankSlate: false,
     noSeed: false,
+    allowTenantWideNamespaces: false,
     client: "desktop",
     tenant: "live",
     help: false
@@ -17155,6 +17662,9 @@ function parseBootstrapArgs(argv) {
       case "--no-seed":
         args.noSeed = true;
         break;
+      case "--allow-tenant-wide-namespaces":
+        args.allowTenantWideNamespaces = true;
+        break;
       case "--tenant": {
         const v = argv[++i];
         if (v !== "test" && v !== "live") {
@@ -17236,15 +17746,6 @@ function reconcileTally(items, noun) {
   if (reconciled) seg.push(`${reconciled} reconciled`);
   return `${items.length} ${noun}${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
 }
-function issuerTally(items) {
-  if (items.length === 0) return null;
-  const created = items.filter((i) => i.action === "created").length;
-  const unchanged = items.length - created;
-  const seg = [];
-  if (created) seg.push(`${created} created`);
-  if (unchanged) seg.push(`${unchanged} already registered \u2014 unchanged (issuers cannot be updated once registered)`);
-  return `${items.length} issuer${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
-}
 function namespaceTally(items) {
   if (items.length === 0) return null;
   const created = items.filter((i) => i.action === "created").length;
@@ -17258,7 +17759,9 @@ function applyOutcomeSummary(result) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
     reconcileTally(result.roleActions, "role"),
-    issuerTally(result.issuerActions),
+    // #1023 — the platform's PUT /v1/auth/issuers/{issuerId} makes an issuer's
+    // 'reconciled' mean the same "updated to match" as every other kind here.
+    reconcileTally(result.issuerActions, "issuer"),
     namespaceTally(result.namespaceActions),
     `profile ${result.profileAction}`
   ].filter((p) => p !== null);
@@ -17291,6 +17794,14 @@ Options:
                            sample seed records \u2014 the right choice for a production context
                            (a blueprint's seeds are illustrative, not real data). Unlike
                            --blank, the schemas are still created.
+  --allow-tenant-wide-namespaces
+                           Required to apply a blueprint that declares a namespace with
+                           tenantWide: true \u2014 visible to every context in the account, not
+                           just this one. Without it, bootstrap refuses before provisioning
+                           anything, naming the namespace(s). Only an account OWNER's
+                           credential can actually complete the registration either way \u2014
+                           this flag doesn't change who's allowed, only whether this run
+                           tries. Never needed for a blueprint with no tenantWide namespace.
   --tenant test|live       Which tenant the minted key scopes to (default: live).
                            'test' provisions into your isolated test tenant \u2014 a
                            dry-run before pointing real data at the same blueprint.
@@ -17473,11 +17984,16 @@ ${BOOTSTRAP_HELP}
       }
       throw err;
     }
-    const gate = evaluateScopeGate(blueprint.accessProfile.allowedActions);
-    process.stdout.write(`
+    const roleNote = blueprint.accessProfile.roleIds ? ` via role(s) [${blueprint.accessProfile.roleIds.join(", ")}]` : "";
+    const acceptedActions = effectiveAccessProfileActions(blueprint);
+    const allDataPlane = !acceptedActions.some(
+      (a) => KNOWN_CONTROL_PLANE_RESOURCES.includes(a.split(":", 1)[0])
+    );
+    process.stdout.write(
+      `
   Blueprint: ${blueprint.name}
-  \u2714 Scope gate: [${gate.accepted.join(", ")}] \u2014 all data-plane \u2713
-`);
+  \u2714 Scope gate: [${acceptedActions.join(", ")}]${roleNote}` + (allDataPlane ? " \u2014 all data-plane \u2713\n" : " \u2014 includes a narrow, allowlisted control-plane exception (see above)\n")
+    );
     if (blueprint.accessProfile.capabilities?.length) {
       const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
       process.stdout.write(`  \u2714 Capability gate: [${capGate.accepted.join(", ")}] \u2014 granted \u2713
@@ -17533,6 +18049,7 @@ ${renderPlan(blueprint, planSteps)}
     process.stdout.write(`  \u2714 Bootstrap token minted (5-min TTL, ${args.tenant} tenant)
 `);
     const pingIdentity = deps.resolveIdentity ?? resolveIdentity;
+    const provision = deps.provisionContext ?? provisionContext;
     const resolveIdentities = deps.resolveApplyTimeIdentities ?? resolveApplyTimeIdentities;
     const loader = deps.runLoader ?? runLoader;
     const client = new VectrosClient({ token: bridge.token, environment: baseUrl });
@@ -17543,11 +18060,6 @@ ${renderPlan(blueprint, planSteps)}
         "Could not resolve tenantId from /v1/ping \u2014 the extended ping (tenant_id) must be deployed for bootstrap."
       );
     }
-    const resolvedBlueprint = await resolveIdentities(
-      blueprint,
-      client,
-      log
-    );
     let keyring;
     let keyringOpenError;
     try {
@@ -17622,6 +18134,27 @@ ${renderPlan(blueprint, planSteps)}
         );
       }
     };
+    const remintBootstrapForContext = buildRemintBootstrapForContext({
+      cognitoToken,
+      apiBaseUrl: baseUrl,
+      tenant: args.tenant,
+      useScopedToken: args.useScopedToken,
+      mintBridge
+    });
+    const confirmExistingPrincipal = buildConfirmExistingPrincipal(args, promptCtx.prompt, isTty);
+    const provisioned = await provision(client, {
+      blueprint,
+      allowTenantWideNamespaces: args.allowTenantWideNamespaces,
+      remintBootstrapForContext,
+      readExistingKey,
+      confirmExistingPrincipal,
+      log
+    });
+    const resolvedBlueprint = await resolveIdentities(
+      blueprint,
+      provisioned.ctxBootstrapClient ?? client,
+      log
+    );
     const machineId = await resolveMachineId();
     const result = await loader(client, {
       blueprint: resolvedBlueprint,
@@ -17629,22 +18162,18 @@ ${renderPlan(blueprint, planSteps)}
       machineId,
       rotate: args.rotate,
       skipSeed: noSeed,
+      allowTenantWideNamespaces: args.allowTenantWideNamespaces,
       readExistingKey,
       persistMintedKey,
-      remintBootstrapForContext: buildRemintBootstrapForContext({
-        cognitoToken,
-        apiBaseUrl: baseUrl,
-        tenant: args.tenant,
-        useScopedToken: args.useScopedToken,
-        mintBridge
-      }),
+      provisioned,
+      remintBootstrapForContext,
       remintForContext: buildRemintForContext({
         cognitoToken,
         apiBaseUrl: baseUrl,
         tenant: args.tenant,
         mintContext
       }),
-      confirmExistingPrincipal: buildConfirmExistingPrincipal(args, promptCtx.prompt, isTty),
+      confirmExistingPrincipal,
       log
     });
     process.stdout.write(
@@ -17735,9 +18264,18 @@ ${codeAddHint}`);
       return 3;
     }
     if (err instanceof BlueprintIdentityError || err instanceof UnresolvedIdentitiesError) {
+      process.stderr.write(
+        `
+  \u2716 ${err.message}
+  The app-context, service principal, and any declared namespaces were already provisioned. No schemas, profile, roles, key, or seed records were.
+`
+      );
+      return 2;
+    }
+    if (err instanceof TenantWideNamespacesNotAllowedError) {
       process.stderr.write(`
   \u2716 ${err.message}
-  No context or key was provisioned.
+  Nothing was provisioned.
 `);
       return 2;
     }
@@ -17812,11 +18350,14 @@ function assertIdentityOverrideValues(overrides, flag) {
   }
 }
 function placeholderScopeNamespace(value) {
-  const m = /^\$\{\{\s*(?:under\.)?self\.scope\.([^\s}]+)\s*\}\}$/.exec(value);
-  return m ? m[1] : null;
+  const self2 = /^\$\{\{\s*(?:under\.)?self\.scope\.([^\s}]+)\s*\}\}$/.exec(value);
+  if (self2) return self2[1];
+  const member = MEMBER_SCOPE_PLACEHOLDER_RE2.exec(value);
+  return member ? member[1] : null;
 }
 var SELF_PLACEHOLDER_RE = /^\$\{\{\s*self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
-var UNDER_SELF_PLACEHOLDER_RE = /^\$\{\{\s*under\.self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
+var UNDER_SELF_PLACEHOLDER_RE2 = /^\$\{\{\s*under\.self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
+var MEMBER_SCOPE_PLACEHOLDER_RE2 = /^\$\{\{\s*member\.scope\.([a-z][a-z0-9_-]{1,31})(?::[a-z][a-z0-9_-]{1,31})?\s*\}\}$/;
 
 // src/lint.ts
 var ENUM_COMPATIBLE_TYPES = /* @__PURE__ */ new Set(["enum", "string", "string[]"]);
@@ -17954,7 +18495,7 @@ function lintBlueprint(bp) {
       }
     }
   }
-  {
+  if (bp.accessProfile.allowedActions !== void 0) {
     const reached = ownerScopedReachWithoutDataScope(bp.accessProfile.allowedActions, ds);
     if (reached.length > 0) findings.push(unconstrainedReachFinding("accessProfile", reached));
   }
@@ -18005,7 +18546,12 @@ function lintBlueprint(bp) {
 }
 var ROLE_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
 var PLACEHOLDER_SHAPED_RE = /^\s*\$\{\{.*\}\}\s*$/s;
-var RECOGNIZED_PLACEHOLDER_RES = [/^\$\{\{\s*any\s*\}\}$/, SELF_PLACEHOLDER_RE, UNDER_SELF_PLACEHOLDER_RE];
+var RECOGNIZED_PLACEHOLDER_RES = [
+  /^\$\{\{\s*any\s*\}\}$/,
+  SELF_PLACEHOLDER_RE,
+  UNDER_SELF_PLACEHOLDER_RE2,
+  MEMBER_SCOPE_PLACEHOLDER_RE2
+];
 var BLUEPRINT_TOKEN_RE = /^\s*\$\{\{\s*(identities|inputs|vectros|ns)\./;
 function placeholderFinding(where, key, value) {
   if (typeof value !== "string" || !PLACEHOLDER_SHAPED_RE.test(value)) return null;
@@ -18023,7 +18569,7 @@ function placeholderFinding(where, key, value) {
   return {
     severity: "error",
     rule: "datascope-unknown-placeholder",
-    message: `${where}: dataScope.${key} value '${value}' is not a placeholder the platform recognizes \u2014 it will be rejected at apply. Valid: \${{ any }}, \${{ self.userId }}, \${{ self.scope.<namespace> }}, \${{ under.self.userId }}, \${{ under.self.scope.<namespace> }}. Spelling is exact and lowercase; use a plain value for a literal owner id.`
+    message: `${where}: dataScope.${key} value '${value}' is not a placeholder the platform recognizes \u2014 it will be rejected at apply. Valid: \${{ any }}, \${{ self.userId }}, \${{ self.scope.<namespace> }}, \${{ under.self.userId }}, \${{ under.self.scope.<namespace> }}, \${{ member.scope.<namespace> }}, \${{ member.scope.<namespace>:<level> }}. Spelling is exact and lowercase; use a plain value for a literal owner id.`
   };
 }
 var OWNER_SCOPED_RESOURCES = /* @__PURE__ */ new Set(["records", "documents", "entities"]);
@@ -18269,11 +18815,11 @@ async function runValidate(args) {
   }
   const blueprint = await resolveAndValidate(args.file, "validate", supplied);
   if (!blueprint) return 2;
-  const gate = evaluateScopeGate(blueprint.accessProfile.allowedActions);
   const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
   const warnCount = lintBlueprint(blueprint).length;
+  const roleNote = blueprint.accessProfile.roleIds ? ` via role(s) [${blueprint.accessProfile.roleIds.join(", ")}]` : "";
   process.stdout.write(
-    `  \u2714 '${blueprint.name}' is valid \u2014 structural \u2713, scope gate \u2713 [${gate.accepted.join(", ")}]` + (capGate.accepted.length ? `, capability gate \u2713 [${capGate.accepted.join(", ")}]` : "") + `, lint \u2713` + (warnCount ? ` (${warnCount} warning${warnCount === 1 ? "" : "s"})` : "") + "\n"
+    `  \u2714 '${blueprint.name}' is valid \u2014 structural \u2713, scope gate \u2713 [${effectiveAccessProfileActions(blueprint).join(", ")}]${roleNote}` + (capGate.accepted.length ? `, capability gate \u2713 [${capGate.accepted.join(", ")}]` : "") + `, lint \u2713` + (warnCount ? ` (${warnCount} warning${warnCount === 1 ? "" : "s"})` : "") + "\n"
   );
   return 0;
 }
@@ -19144,6 +19690,52 @@ async function runIdentityDelete(opts, deps = {}) {
     }
   });
 }
+function renderInvite(v) {
+  return formatKeyValues([
+    ["userId", v.userId],
+    ["inviteExpiresAt", v.inviteExpiresAt],
+    ["emailSent", v.emailSent === void 0 ? void 0 : String(v.emailSent)],
+    ["inviteToken", v.inviteToken],
+    ["acceptLink", v.acceptLink]
+  ]);
+}
+async function runIdentityInvite(opts, deps = {}) {
+  const sendEmail = !opts.noSendEmail;
+  if (sendEmail && !opts.acceptUrl) {
+    process.stderr.write(
+      "  \u2716 --accept-url is required unless --no-send-email is given (the platform delivers the invitation email itself and needs somewhere to point it).\n"
+    );
+    return 2;
+  }
+  return withAuth(opts, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const invite = await client.auth.createInvite({
+        email: opts.email,
+        contextId: opts.context,
+        accessProfile: { roleId: opts.role },
+        firstName: opts.firstName,
+        acceptUrl: opts.acceptUrl,
+        sendEmail
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(invite)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        `
+  \u2714 Invited '${opts.email}' to '${opts.context}' as '${opts.role}'
+${renderInvite(invite)}
+`
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "identity invite failed" }));
+      return 1;
+    }
+  });
+}
 
 // src/commands/access.ts
 function assertPrincipalShape(principal) {
@@ -19162,20 +19754,24 @@ async function resolvePrincipalArg(raw, auth) {
   }
   return self2.principalId;
 }
+function roleSummary(p) {
+  if (p.roleIds?.length) return p.roleIds.join(", ");
+  return p.roleId;
+}
 function renderProfile(p) {
   return formatKeyValues([
     ["context", p.contextId],
     ["principal", p.principalId],
-    ["role", p.roleId],
+    ["role", roleSummary(p)],
     ["scopes", p.scopes?.length ? `${p.scopes.length} clause(s)` : void 0],
     ["status", p.status]
   ]);
 }
 async function runAccessGrant(opts, deps = {}) {
-  const hasRole = Boolean(opts.role);
+  const hasRole = Boolean(opts.role?.length);
   const hasActions = Boolean(opts.actions);
   if (hasRole === hasActions) {
-    process.stderr.write("  \u2716 Provide exactly one of --role <roleId> or --actions <csv>.\n");
+    process.stderr.write("  \u2716 Provide exactly one of --role <roleId> (repeatable) or --actions <csv>.\n");
     return 2;
   }
   if (hasActions && splitCsv(opts.actions).length === 0) {
@@ -19215,7 +19811,11 @@ async function runAccessGrant(opts, deps = {}) {
         upsert: true,
         body: {
           principalId: principal,
-          roleId: opts.role,
+          // Always send the plural `roleIds`, even for a single
+          // `--role`: it is a strict superset of the deprecated singular
+          // `roleId` (equivalent to `roleIds: ["<value>"]`), and the platform
+          // reads it uniformly regardless of how many roles compose.
+          roleIds: opts.role,
           scopes,
           identityOverrides
         }
@@ -19227,7 +19827,7 @@ async function runAccessGrant(opts, deps = {}) {
       }
       process.stdout.write(
         `
-  \u2714 Granted ${principal} in '${opts.context}'` + (hasRole ? ` via role '${opts.role}'` : ` with ${splitCsv(opts.actions).length} action(s)`) + `
+  \u2714 Granted ${principal} in '${opts.context}'` + (hasRole ? ` via role(s) [${opts.role.join(", ")}]` : ` with ${splitCsv(opts.actions).length} action(s)`) + `
 ${renderProfile(profile)}
 `
       );
@@ -19296,7 +19896,7 @@ async function runAccessList(opts, deps = {}) {
         "\n" + formatTable(rows, [
           { header: "context", get: (r) => r.contextId },
           { header: "principal", get: (r) => r.principalId },
-          { header: "role", get: (r) => r.roleId ?? (r.scopes?.length ? "(inline)" : void 0) },
+          { header: "role", get: (r) => roleSummary(r) ?? (r.scopes?.length ? "(inline)" : void 0) },
           { header: "status", get: (r) => r.status }
         ]) + "\n"
       );
@@ -19344,6 +19944,7 @@ ${renderProfile(p)}
 var SELF = /* @__PURE__ */ Symbol("self");
 var ANY = /* @__PURE__ */ Symbol("any");
 var UNDER_SELF = /* @__PURE__ */ Symbol("under.self");
+var MEMBER = /* @__PURE__ */ Symbol("member.scope");
 function canonicalDim(key) {
   if (key === "userId" || key === "partnerUserId") return "user";
   return key;
@@ -19373,7 +19974,8 @@ function normalizeClauses(raw) {
         if (val === null) return null;
         const s = String(val);
         if (ANY_TOKEN_RE.test(s)) return ANY;
-        if (UNDER_SELF_PLACEHOLDER_RE.test(s)) return UNDER_SELF;
+        if (UNDER_SELF_PLACEHOLDER_RE2.test(s)) return UNDER_SELF;
+        if (MEMBER_SCOPE_PLACEHOLDER_RE2.test(s)) return MEMBER;
         return SELF_PLACEHOLDER_RE.test(s) ? SELF : s;
       });
       if (!isRecognizedOwnershipKey(k)) unrecognizedDims.push(k);
@@ -19428,7 +20030,7 @@ function buildArchetypes(clauses) {
       const set = scopeDims.get(dim) ?? /* @__PURE__ */ new Set();
       set.add(SELF);
       for (const v of values) {
-        if (v === null || v === ANY || v === UNDER_SELF) continue;
+        if (v === null || v === ANY || v === UNDER_SELF || v === MEMBER) continue;
         set.add(v);
       }
       scopeDims.set(dim, set);
@@ -19455,6 +20057,7 @@ function listAdmits(allowed, recordValue) {
     if (a === SELF) return recordValue === SELF;
     if (a === ANY) return recordValue !== void 0;
     if (a === UNDER_SELF) return false;
+    if (a === MEMBER) return false;
     return recordValue === a;
   });
 }
@@ -19480,7 +20083,7 @@ function undecidableDims(clauses) {
   const dims = /* @__PURE__ */ new Set();
   for (const c of clauses) {
     for (const [dim, values] of Object.entries(c.dataScope)) {
-      if (values.includes(UNDER_SELF)) dims.add(dim);
+      if (values.includes(UNDER_SELF) || values.includes(MEMBER)) dims.add(dim);
     }
   }
   return [...dims];
@@ -19513,6 +20116,7 @@ function renderDataScope(ds) {
       if (v === SELF) return "self";
       if (v === ANY) return "any";
       if (v === UNDER_SELF) return "under-self";
+      if (v === MEMBER) return "member";
       if (v === null) return "null";
       return v;
     });
@@ -19544,14 +20148,25 @@ async function runAccessExplain(opts, deps = {}) {
       const profile = await client.auth.getAccessProfile({ contextId: opts.context, principalId: principal });
       let rawClauses = profile.scopes ?? [];
       let via = "inline scopes";
-      if (profile.roleId) {
-        const role = await client.auth.getRole({ contextId: opts.context, roleId: profile.roleId });
-        rawClauses = role.scopes ?? [];
-        via = `role '${profile.roleId}'`;
+      const roleIds = profile.roleIds ?? (profile.roleId ? [profile.roleId] : []);
+      if (roleIds.length > 0) {
+        const roleClauses = [];
+        for (const roleId of roleIds) {
+          const role = await client.auth.getRole({ contextId: opts.context, roleId });
+          roleClauses.push(...role.scopes ?? []);
+        }
+        rawClauses = roleClauses;
+        via = roleIds.length === 1 ? `role '${roleIds[0]}'` : `role(s) [${roleIds.join(", ")}]`;
       }
       const clauses = normalizeClauses(rawClauses);
       const rows = explainClauses(clauses);
       const undecidable = undecidableDims(clauses);
+      const hasUnderSelfUndecidable = clauses.some(
+        (c) => Object.values(c.dataScope).some((values) => values.includes(UNDER_SELF))
+      );
+      const hasMemberUndecidable = clauses.some(
+        (c) => Object.values(c.dataScope).some((values) => values.includes(MEMBER))
+      );
       if (opts.json) {
         process.stdout.write(
           `${formatJson({
@@ -19608,10 +20223,7 @@ async function runAccessExplain(opts, deps = {}) {
         ]) + (undecidable.length > 0 ? `
 
   \u26A0 UNDECIDED offline: ${undecidable.join(", ")}
-  A clause matching on \`\${{ under.self.* }}\` needs the parent graph, which only the server has,
-  so rows granted through it are shown as NO above. Read those cells as "cannot tell here",
-  NOT as a denial \u2014 the matrix under-reports this clause.
-` : "") + '\n\n  \u26A0 READ ONLY: "granted?"/"actions" model whether a row can be READ, not whether a c/u/d\n  verb shown there can actually WRITE that row\'s exact shape \u2014 the platform requires a clause\n  to name a dimension to place a value into it, while reads are never narrowed by a dimension a\n  clause omits. A create/update verb next to a row is advisory: it names which records exist to\n  act on, not that a specific write will succeed.\n\n\n  NOTE: this matrix models the OWNERSHIP dimensions only \u2014 "granted?" says a row\'s ownership\n  shape matches a clause, and "record types" (above) says which `records:` types that grant\n  actually reaches; "all" reaches every type, "\u2014" means no `records:` action grants this row at\n  all. Search/RAG visibility is a separate, still-unmodeled narrowing: it is bounded per row by\n  the SAME clause\'s typed read grants \u2014 a row shown with `search:r` is searchable only for the\n  content types that clause can read.\n  Preview only \u2014 computed client-side from the documented matching rules; the platform decides at request time.\n'
+` + (hasUnderSelfUndecidable ? "  A clause matching on `${{ under.self.* }}` needs the server's parent graph, which this\n  preview does not have, so rows granted through it are shown as NO above.\n" : "") + (hasMemberUndecidable ? "  A clause matching on `${{ member.scope.<ns>[:<level>] }}` needs a live per-request read of\n  this account's membership records, which this preview does not have, so rows granted\n  through it are shown as NO above.\n" : "") + '  Read those cells as "cannot tell here", NOT as a denial \u2014 the matrix under-reports\n  whichever clause(s) above are responsible.\n' : "") + '\n\n  \u26A0 READ ONLY: "granted?"/"actions" model whether a row can be READ, not whether a c/u/d\n  verb shown there can actually WRITE that row\'s exact shape \u2014 the platform requires a clause\n  to name a dimension to place a value into it, while reads are never narrowed by a dimension a\n  clause omits. A create/update verb next to a row is advisory: it names which records exist to\n  act on, not that a specific write will succeed.\n\n\n  NOTE: this matrix models the OWNERSHIP dimensions only \u2014 "granted?" says a row\'s ownership\n  shape matches a clause, and "record types" (above) says which `records:` types that grant\n  actually reaches; "all" reaches every type, "\u2014" means no `records:` action grants this row at\n  all. Search/RAG visibility is a separate, still-unmodeled narrowing: it is bounded per row by\n  the SAME clause\'s typed read grants \u2014 a row shown with `search:r` is searchable only for the\n  content types that clause can read.\n  Preview only \u2014 computed client-side from the documented matching rules; the platform decides at request time.\n'
       );
       return 0;
     } catch (err) {
@@ -19629,7 +20241,8 @@ function renderRole(r) {
     ["name", r.name],
     ["context", r.contextId],
     ["description", r.description],
-    ["scopes", r.scopes?.length ? `${r.scopes.length} clause(s)` : void 0]
+    ["scopes", r.scopes?.length ? `${r.scopes.length} clause(s)` : void 0],
+    ["assumable", r.assumable && Object.keys(r.assumable).length ? formatJson(r.assumable) : void 0]
   ]);
 }
 async function runRoleCreate(opts, deps = {}) {
@@ -19900,6 +20513,75 @@ ${renderContext(ctx)}
   });
 }
 
+// src/commands/issuers.ts
+function renderSelfSignup(policies) {
+  if (!policies || policies.length === 0) return "\u2014";
+  return policies.map((p) => `${p.signup_type} \u2192 ${p.role_id}`).join(", ");
+}
+function renderIssuer(i) {
+  return formatKeyValues([
+    ["issuerId", i.issuerId],
+    ["issuer", i.issuer],
+    ["jwksUri", i.jwksUri],
+    ["audience", i.audience],
+    ["contextId", i.contextId],
+    ["subClaim", i.subClaim],
+    ["emailClaim", i.emailClaim],
+    ["userinfoUri", i.userinfoUri],
+    ["status", i.status],
+    ["createdAt", i.createdAt],
+    ["selfSignup", renderSelfSignup(i.selfSignupPolicies)]
+  ]);
+}
+async function runIssuersList(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const rows = await drainPages(
+        (startFrom) => client.auth.listIssuers({ limit: PAGE_LIMIT, ...startFrom ? { startFrom } : {} })
+      );
+      if (opts.json) {
+        process.stdout.write(`${formatJson(rows)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        "\n" + formatTable(rows, [
+          { header: "issuerId", get: (i) => i.issuerId },
+          { header: "issuer", get: (i) => i.issuer },
+          { header: "audience", get: (i) => i.audience },
+          { header: "status", get: (i) => i.status },
+          { header: "self-signup", get: (i) => renderSelfSignup(i.selfSignupPolicies) }
+        ]) + "\n"
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "issuers list failed" }));
+      return 1;
+    }
+  });
+}
+async function runIssuersGet(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const issuer = await client.auth.getIssuer({ issuerId: opts.issuerId });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(issuer)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+${renderIssuer(issuer)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "issuers get failed" }));
+      return 1;
+    }
+  });
+}
+
 // src/commands/login.ts
 var import_node_http = require("http");
 var import_open = __toESM(require("open"));
@@ -20121,7 +20803,7 @@ async function runAssertions(client, bootstrapClient, deps, blueprint, tenantId,
   const assertions = [];
   try {
     const ping = await deps.pingWithKey(result.rawKey);
-    const wantActions = blueprint.accessProfile.allowedActions;
+    const wantActions = effectiveAccessProfileActions(blueprint);
     const got = ping.allowedActions ?? [];
     const missing = wantActions.filter((a) => !got.includes(a));
     const ok = ping.principalType === "scoped_key" && ping.tenantId === tenantId && missing.length === 0;
@@ -20355,15 +21037,21 @@ async function runBlueprintHarness(client, input, deps) {
   const readExistingKey = async () => void 0;
   const persistMintedKey = async () => {
   };
+  const provisioned = await provisionContext(client, {
+    blueprint: input.blueprint,
+    remintBootstrapForContext,
+    readExistingKey,
+    log
+  });
   const blueprint = await resolveApplyTimeIdentities(
     input.blueprint,
-    client,
+    provisioned.ctxBootstrapClient ?? client,
     log
   );
   const remint = remintForContext ?? (async () => client);
   const remintBootstrap = remintBootstrapForContext ?? (async () => client);
   const hasIssuers = (blueprint.issuers ?? []).length > 0;
-  const hasNamespaces = (blueprint.namespaces ?? []).length > 0;
+  const hasNamespaces = provisioned.namespaceActions.length > 0;
   let contextSnapshot;
   if (remintForContext) {
     try {
@@ -20407,6 +21095,7 @@ async function runBlueprintHarness(client, input, deps) {
       readExistingKey,
       persistMintedKey,
       log,
+      provisioned,
       remintForContext,
       remintBootstrapForContext
     });
@@ -20625,12 +21314,13 @@ async function issueOrRotateKey(client, tenantId, context, userId, keyName) {
   return { key: rotated, revokedKeyId: existing?.keyId };
 }
 async function runJoin(opts, deps = {}) {
-  const hasRole = Boolean(opts.role);
+  const hasRole = Boolean(opts.role?.length);
   const hasActions = Boolean(opts.actions);
   if (hasRole === hasActions) {
-    process.stderr.write("  \u2716 Provide exactly one of --role <roleId> or --actions <csv>.\n");
+    process.stderr.write("  \u2716 Provide exactly one of --role <roleId> (repeatable) or --actions <csv>.\n");
     return 2;
   }
+  const roleDisplay = opts.role?.join(", ");
   if (hasActions && splitCsv(opts.actions).length === 0) {
     process.stderr.write("  \u2716 --actions needs at least one action (an empty/blank list grants nothing).\n");
     return 2;
@@ -20678,7 +21368,10 @@ async function runJoin(opts, deps = {}) {
         upsert: true,
         body: {
           principalId,
-          roleId: opts.role,
+          // Always send the plural `roleIds`, even for a single
+          // `--role`: a strict superset of the deprecated singular `roleId`,
+          // read uniformly by the platform regardless of how many compose.
+          roleIds: opts.role,
           scopes,
           identityOverrides
         }
@@ -20697,7 +21390,7 @@ async function runJoin(opts, deps = {}) {
           alias,
           context,
           principalId,
-          role: opts.role,
+          role: roleDisplay,
           keyId: existingEntry.keyId,
           reused: true,
           tenant,
@@ -20718,7 +21411,7 @@ async function runJoin(opts, deps = {}) {
       const willActivate = await determineActivateDecision(keyring, { tenant, explicitActivate: opts.activate });
       const { entry } = await storeMintedKey(
         keyring,
-        { alias, context, principalId, role: opts.role, keyId: key.keyId, env: auth.env },
+        { alias, context, principalId, role: roleDisplay, keyId: key.keyId, env: auth.env },
         key.rawKey,
         { activate: willActivate, revokedKeyId }
       );
@@ -20726,7 +21419,7 @@ async function runJoin(opts, deps = {}) {
         alias,
         context,
         principalId,
-        role: opts.role,
+        role: roleDisplay,
         keyId: entry.keyId,
         reused: false,
         tenant,
@@ -20765,9 +21458,9 @@ function emitJoined(opts) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.16.0" : "dev",
-  sdk: true ? "0.40.0" : "dev",
-  blueprints: true ? "0.13.0" : "dev"
+  cli: true ? "0.19.0" : "dev",
+  sdk: true ? "0.41.0" : "dev",
+  blueprints: true ? "0.16.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -20847,12 +21540,13 @@ function buildProgram(deps = {}) {
   registerAccessCommands(program, deps);
   registerRoleCommands(program, deps);
   registerContextCommands(program, deps);
+  registerIssuersCommands(program, deps);
   registerJoinCommand(program, deps);
   registerKeyringCommands(program);
   return program;
 }
 function registerJoinCommand(program, deps) {
-  const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (XOR --actions)").option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option(
+  const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option(
     "--activate",
     "force the freshly-stored key to become your active identity, even over a currently-active LIVE credential (the one case --tenant test does NOT do automatically)"
   ).option("--no-activate", "store the key without activating it, regardless of tenant");
@@ -20986,6 +21680,27 @@ function registerContextCommands(program, deps) {
     }
   );
 }
+function registerIssuersCommands(program, deps) {
+  const issuers = program.command("issuers").description("Inspect registered third-party IdP issuers (token-exchange trust anchors).");
+  const list = issuers.command("list").description("List issuers registered in one app context.").requiredOption("--context <c>", "app context the issuer(s) are registered under").option("--tenant <tenant>", "tenant to read: 'test' or 'live' (default live)");
+  addCommonAuthOptions(list).action(
+    async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(
+        await runIssuersList({ ...toCommonOptions(flags), context: flags.context, tenant }, deps)
+      );
+    }
+  );
+  const get = issuers.command("get").description("Show one registered issuer.").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--tenant <tenant>", "tenant to read: 'test' or 'live' (default live)");
+  addCommonAuthOptions(get).action(
+    async (issuerId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(
+        await runIssuersGet({ ...toCommonOptions(flags), context: flags.context, issuerId, tenant }, deps)
+      );
+    }
+  );
+}
 function registerRoleCommands(program, deps) {
   const role = program.command("role").description("Manage context-scoped roles (reusable scope rules; bind via `access grant --role`).");
   const create = role.command("create").description("Create (idempotent by roleId) a single-clause role from --actions.").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id (3-31 chars; lowercase letter + lowercase/digit/dash)").requiredOption("--name <name>", "human-readable name").requiredOption("--actions <csv>", "allowed actions, comma-separated (e.g. records:cru,search:r)").option(
@@ -21022,7 +21737,7 @@ function registerRoleCommands(program, deps) {
 }
 function registerAccessCommands(program, deps) {
   const access2 = program.command("access").description("Manage access bindings: principal \u2194 context \u2194 role/scopes.");
-  const grant = access2.command("grant").description("Bind a principal to a context via a role or inline actions.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--role <roleId>", "reference a Role (XOR --actions)").option("--actions <csv>", "inline single-clause actions, comma-separated (XOR --role)").option("--scope <ns:value>", "identity override: a scope the principal acts under (repeatable, e.g. org:<id>)", collect, []).option("--identity-overrides <json>", "general identity overrides as a JSON object (merged over --scope)");
+  const grant = access2.command("grant").description("Bind a principal to a context via a role or inline actions.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--role <roleId>", "reference a Role (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions, comma-separated (XOR --role)").option("--scope <ns:value>", "identity override: a scope the principal acts under (repeatable, e.g. org:<id>)", collect, []).option("--identity-overrides <json>", "general identity overrides as a JSON object (merged over --scope)");
   addCommonAuthOptions(grant).action(
     async (flags) => {
       process.exit(
@@ -21103,6 +21818,25 @@ function registerIdentityCommands(program, deps) {
   addAuthOptions(del).action(async (flags) => {
     process.exit(await runIdentityDelete({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps));
   });
+  const invite = identity.command("invite").description("Onboard a person into a context by email (POST /v1/users/invite) \u2014 no root key required.").requiredOption("--context <contextId>", "the app context the invitee will operate in").requiredOption("--role <roleId>", "an existing Role in that context; the invitee inherits its scopes").requiredOption("--email <email>", "the invitee's email address").option("--first-name <name>", "personalizes the invitation email greeting").option("--accept-url <url>", "your accept-invite landing page (required unless --no-send-email)").option("--no-send-email", "skip platform delivery; the response carries the raw inviteToken/acceptLink instead");
+  addCommonAuthOptions(invite).action(
+    async (flags) => {
+      process.exit(
+        await runIdentityInvite(
+          {
+            ...toCommonOptions(flags),
+            context: flags.context,
+            role: flags.role,
+            email: flags.email,
+            firstName: flags.firstName,
+            acceptUrl: flags.acceptUrl,
+            noSendEmail: flags.sendEmail === false
+          },
+          deps
+        )
+      );
+    }
+  );
 }
 function addKeyDestinationOptions(cmd) {
   return cmd.addOption(new import_commander.Option("--format <fmt>", "how to emit the secret").choices(KEY_FORMATS).default("human")).option(