@vectros-ai/cli 0.19.0 → 0.20.0

package/dist/cli.js

@@ -6104,7 +6104,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token");
   }
   /**
-   * Invite a new member to one of your app contexts by email, OR grant an existing member access to an additional app context by inviting their same email again. Idempotent on the combination of context and email: re-inviting the same email into the SAME context rotates the token and resends the invitation rather than creating a duplicate — this requires the `users:r` and `users:u` scopes in addition to `users:c`, because resending rotates a credential on an existing invitation and invalidates any link already sent. Without them the collision returns 409 instead, with no invitation details and no change to the outstanding invitation. Inviting the SAME email into a DIFFERENT app context in this tenant, where that email already resolves to an existing member: if that member is active AND already has (or, once accepted, will have) a credential that works for the new context's own identity provider, this immediately grants them access to the new context (no email is sent — there is nothing to accept, `emailSent` is false) — this additionally requires the `users:r` scope (no `users:u`, since nothing is mutated), because the response names the existing member's userId, a fact about them your credential could not otherwise learn through this endpoint. If that active member's ONLY existing credential is for a DIFFERENT identity provider than the one the new context uses, a normal, independent invitation is created instead (its own new member id, a real token/accept link) — attaching them silently would leave no way for them to ever actually sign in to that context. If the existing member's original invitation is still pending, this attaches the new context's access to that same outstanding invitation and rotates its token (`users:r`+`users:u`, same as an ordinary resend — both the disclosure and the credential rotation apply here). A SUSPENDED member's email does not get new-context access this way — reactivate them explicitly first. Returns HTTP 201 in every one of those cases. Returns 409 if that email already belongs to an active or suspended member of THIS specific app context, already has a PENDING invitation for THIS specific app context, or resolves to an existing member elsewhere in the tenant and your token lacks the additional scope the grant/attach requires (`users:r`, or `users:r`+`users:u` for the still-pending case). An email that already has an identity in your OTHER tenant (test vs. live) is not a collision either — it creates an additional, independent membership in this tenant for that same identity. When `sendEmail` is false, the response includes the raw token and a ready-to-use accept link so you can deliver the invitation through your own email provider. Requires the `users:c` scope.
+   * Invite a new member to one of your app contexts by email, OR grant an existing member access to an additional app context by inviting their same email again. Idempotent on the combination of context and email: re-inviting the same email into the SAME context rotates the token and resends the invitation rather than creating a duplicate — this requires the `users:r` and `users:u` scopes in addition to `users:c`, because resending rotates a credential on an existing invitation and invalidates any link already sent. Without them the collision returns 409 instead, with no invitation details and no change to the outstanding invitation. Inviting the SAME email into a DIFFERENT app context in this tenant, where that email already resolves to an existing member: if that member is active AND already has (or, once accepted, will have) a credential that works for the new context's own identity provider, this immediately grants them access to the new context (no email is sent — there is nothing to accept, `emailSent` is false) — this additionally requires the `users:r` scope (no `users:u`, since nothing is mutated), because the response names the existing member's userId, a fact about them your credential could not otherwise learn through this endpoint. If that active member's ONLY existing credential is for a DIFFERENT identity provider than the one the new context uses, a normal, independent invitation is created instead (its own new member id, a real token/accept link) — attaching them silently would leave no way for them to ever actually sign in to that context. If the existing member's original invitation is still pending, this attaches the new context's access to that same outstanding invitation and rotates its token (`users:r`+`users:u`, same as an ordinary resend — both the disclosure and the credential rotation apply here). A SUSPENDED member's email does not get new-context access this way — reactivate them explicitly first. Returns HTTP 201 in every one of those cases. Returns 409 if that email already belongs to an active or suspended member of THIS specific app context, already has a PENDING invitation for THIS specific app context, or resolves to an existing member elsewhere in the tenant and your token lacks the additional scope the grant/attach requires (`users:r`, or `users:r`+`users:u` for the still-pending case). An email that already has an identity in your OTHER tenant (test vs. live) is not a collision either — it creates an additional, independent membership in this tenant for that same identity. When `sendEmail` is false, the response includes the raw token and a ready-to-use accept link so you can deliver the invitation through your own email provider. Requires the `users:c` scope — or, for a credential scoped to a single app context, the `member-lifecycle` capability plus the matching `profiles:c`/`profiles:r`/`profiles:u` grant(s) in that context, as an equally sufficient alternative to every `users:c`/`users:r`/`users:u` requirement in this description.
    *
    * @param {Vectros.CreateInviteRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6175,7 +6175,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/invite");
   }
   /**
-   * Resend an outstanding invitation, identified by its email and app context. Rotates the invitation token and extends its expiry, then (when `sendEmail` is true) re-delivers the email. Rotating the token invalidates any previously issued link for this invitation, so only the newest link works. The invitee's pending permissions are left unchanged. Because this rotates a credential on an existing invitation, it requires the `users:c`, `users:r` and `users:u` scopes.
+   * Resend an outstanding invitation, identified by its email and app context. Rotates the invitation token and extends its expiry, then (when `sendEmail` is true) re-delivers the email. Rotating the token invalidates any previously issued link for this invitation, so only the newest link works. The invitee's pending permissions are left unchanged. Because this rotates a credential on an existing invitation, it requires the `users:c`, `users:r` and `users:u` scopes — or, for a credential scoped to a single app context, the `member-lifecycle` capability plus the matching `profiles:c`/`profiles:r`/`profiles:u` grant(s) in that context.
    *
    * @param {Vectros.CreateInviteRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7048,7 +7048,21 @@ var DocumentsClient = class {
     return HttpResponsePromise.fromPromise(this.__lookupDocuments(request, requestOptions));
   }
   async __lookupDocuments(request, requestOptions) {
-    const { type: type_, field, value, from: from_, to, prefix, startFrom, limit, order, userId, scope } = request;
+    const {
+      type: type_,
+      field,
+      value,
+      from: from_,
+      to,
+      prefix,
+      sortFrom,
+      sortTo,
+      startFrom,
+      limit,
+      order,
+      userId,
+      scope
+    } = request;
     const _queryParams = {
       type: type_,
       field,
@@ -7056,6 +7070,8 @@ var DocumentsClient = class {
       from: from_,
       to,
       prefix,
+      sortFrom,
+      sortTo,
       startFrom,
       limit,
       order: order != null ? order : void 0,
@@ -11027,7 +11043,21 @@ var BlueprintSchemaSchema = import_zod.z.object({
   // (it becomes that name's shared base). Must point directly at the base (one
   // hop); immutable once set. Mirrors the `basedOn` field on the platform's
   // schema-create request.
-  basedOn: import_zod.z.string().min(1).optional()
+  basedOn: import_zod.z.string().min(1).optional(),
+  // ADVISORY ONLY — not sent to the platform, never runtime-enforced. The
+  // ownership dimensions this schema's records are typically scoped by
+  // (e.g. ['org', 'client']), declared so the CLI's blueprint lint can warn
+  // when a role clause grants r/u/d on this type but its `dataScope` names
+  // only SOME of these dims — a schema author's easiest way to leave a
+  // dimension unintentionally unconstrained, since reads (unlike creates)
+  // never require full-dimension `dataScope` coverage — this helps an
+  // author NOTICE that read/write asymmetry, not change it; the asymmetry
+  // itself is a ratified, deliberate platform behavior.
+  // Same grammar as a `dataScope` key with the `scope:` prefix stripped:
+  // a bare namespace name, or 'userId' for the principal dimension.
+  // Structural-only here (validated below by `lintExpectedScopeDims`); the
+  // cross-referencing lint against role clauses lives in `packages/cli`.
+  expectedScopeDims: import_zod.z.array(import_zod.z.string().min(1)).max(MAX_SCOPE_DIMENSIONS).optional()
 }).strict().superRefine((schema, ctx) => {
   const hasComposite = (schema.lookupFields ?? []).some(
     (lf) => typeof lf === "object" && lf.fieldNames !== void 0
@@ -11078,8 +11108,8 @@ var BlueprintAccessProfileSchema = import_zod.z.object({
   //
   // Optional now: mutually exclusive with `roleIds` below (the
   // `.superRefine` on this schema enforces the XOR, mirroring the platform's
-  // own `AccessProfileDB.validateScopesXorRole`). Exactly one of the two
-  // authors this profile's grant.
+  // own access-profile scopes/role-composition XOR check). Exactly one of
+  // the two authors this profile's grant.
   allowedActions: import_zod.z.array(import_zod.z.string().min(1)).min(1).optional(),
   // Additive role composition: this profile's effective grant is
   // each named role's own clauses, concatenated in the order listed, instead of
@@ -11682,6 +11712,35 @@ function lintDataScopeKeys(value, ctx) {
     }
   }
 }
+function lintExpectedScopeDims(value, ctx) {
+  const bp = value;
+  (bp.schemas ?? []).forEach((schema, i) => {
+    const dims = schema.expectedScopeDims;
+    if (!dims) return;
+    const seen = /* @__PURE__ */ new Set();
+    dims.forEach((raw, j) => {
+      const dim = String(raw);
+      const path4 = ["schemas", i, "expectedScopeDims", j];
+      if (seen.has(dim)) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: path4,
+          message: `schema '${schema.typeName}': expectedScopeDims lists '${dim}' more than once.`
+        });
+      }
+      seen.add(dim);
+      if (dim === "userId") return;
+      const nsError = scopeNamespaceGrammarError(dim);
+      if (nsError !== null) {
+        ctx.addIssue({
+          code: import_zod.z.ZodIssueCode.custom,
+          path: path4,
+          message: `schema '${schema.typeName}': expectedScopeDims['${dim}'] ${nsError}`
+        });
+      }
+    });
+  });
+}
 function lintDataScopeRefs(value, ctx) {
   const bp = value;
   const declared = new Set(Object.keys(bp.fragments ?? {}));
@@ -11874,6 +11933,15 @@ var BlueprintSchema = import_zod.z.object({
   }),
   /** Human-readable app-context name; defaults to `MCP — <name>` (see {@link contextNameOf}) when absent. */
   contextName: import_zod.z.string().min(1).optional(),
+  /**
+   * The deploying organization's own display name — distinct from {@link contextName}.
+   * `contextName` is the blueprint author's fixed identity for the app (the same for every
+   * deployer); `companyName` is meant to vary per install, typically templated from a
+   * deployer-supplied `${{ inputs.x }}` value rather than hardcoded. Used for branding on
+   * platform-sent correspondence (e.g. invite emails) alongside `contextName` — not a
+   * replacement for it. See {@link companyNameOf}.
+   */
+  companyName: import_zod.z.string().min(1).optional(),
   schemas: import_zod.z.array(BlueprintSchemaSchema).default([]),
   accessProfile: BlueprintAccessProfileSchema,
   servicePrincipal: BlueprintServicePrincipalSchema,
@@ -11922,6 +11990,7 @@ var BlueprintSchema = import_zod.z.object({
   lintIdentityOverrides(bp, ctx);
   lintNamespacedScopeArrays(bp, ctx);
   lintDataScopeKeys(bp, ctx);
+  lintExpectedScopeDims(bp, ctx);
   lintDataScopeRefs(bp, ctx);
   lintRoleAssumable(bp, ctx);
   lintAccessProfileRoleIds(bp, ctx);
@@ -14104,6 +14173,7 @@ var ENV_BASE_URLS = {
   // `--base-url` or VECTROS_API_BASE_URL; verify at smoke time.
   staging: "https://api.staging.vectros.ai"
 };
+var AUTH_FLAG_NAMES = ["--env", "--base-url", "--token", "--use-scoped-token"];
 function envToBaseUrl(env, override) {
   return validateBaseUrl(override ?? ENV_BASE_URLS[env]);
 }
@@ -14610,7 +14680,7 @@ ${summary}`
     this.rejected = rejected;
   }
 };
-var GRANTED_CAPABILITIES_ALLOWLIST = ["member-lifecycle"];
+var GRANTED_CAPABILITIES_ALLOWLIST = ["member-lifecycle", "delegate-principal-stamp"];
 var GRANTED_CAPABILITIES_SET = new Set(GRANTED_CAPABILITIES_ALLOWLIST);
 var CAPABILITIES_HINT = GRANTED_CAPABILITIES_ALLOWLIST.join("/");
 var CapabilityGateError = class extends Error {
@@ -14887,7 +14957,8 @@ function makeIdentityResolver(client, log) {
     return id;
   };
 }
-async function resolveApplyTimeIdentities(blueprint, client, log) {
+async function resolveApplyTimeIdentities(blueprint, provisioned, bootstrapClient, log) {
+  const client = provisioned.ctxBootstrapClient ?? bootstrapClient;
   const resolver = makeIdentityResolver(client, log);
   const resolved = await resolveBlueprintIdentities(blueprint, resolver);
   return parseBlueprint(resolved);
@@ -15155,21 +15226,13 @@ async function runLoader(client, input) {
     machineId,
     rotate = false,
     skipSeed = false,
-    allowTenantWideNamespaces = false,
+    seedIndexPoll,
+    provisioned,
     readExistingKey,
     persistMintedKey,
-    confirmExistingPrincipal,
     log
   } = input;
   assertNoUnresolvedIdentities(blueprint);
-  const provisioned = input.provisioned ?? await provisionContext(client, {
-    blueprint,
-    allowTenantWideNamespaces,
-    remintBootstrapForContext: input.remintBootstrapForContext,
-    readExistingKey,
-    confirmExistingPrincipal,
-    log
-  });
   const { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions } = provisioned;
   assertBlueprintGates(blueprint);
   const needsContextPinnedBootstrapForIssuers = (blueprint.issuers ?? []).length > 0;
@@ -15348,6 +15411,7 @@ async function runLoader(client, input) {
   const seededRecordIds = [];
   const seededDocumentIds = [];
   const seedIndexFailures = [];
+  const pendingIndexSeeds = [];
   const noteIfIndexFailed = (created, rec, surface) => {
     if (created.indexStatus !== "FAILED") return;
     seedIndexFailures.push({
@@ -15382,6 +15446,9 @@ async function runLoader(client, input) {
         }
       });
       if (created.id) seededDocumentIds.push(created.id);
+      if (created.id && created.indexStatus === "PENDING_INDEX") {
+        pendingIndexSeeds.push({ id: created.id, externalId: rec.externalId, typeName: rec.typeName, surface: "document" });
+      }
       noteIfIndexFailed(created, rec, "document");
     } else {
       const created = await ctxClient.records.createRecord({
@@ -15394,10 +15461,30 @@ async function runLoader(client, input) {
         }
       });
       if (created.id) seededRecordIds.push(created.id);
+      if (created.id && created.indexStatus === "PENDING_INDEX") {
+        pendingIndexSeeds.push({ id: created.id, externalId: rec.externalId, typeName: rec.typeName, surface: "record" });
+      }
       noteIfIndexFailed(created, rec, "record");
     }
     seededCount++;
   }
+  const pollAttempts = seedIndexPoll?.attempts ?? 3;
+  const pollDelayMs = seedIndexPoll?.delayMs ?? 500;
+  if (pollAttempts > 0 && pendingIndexSeeds.length > 0) {
+    await Promise.all(
+      pendingIndexSeeds.map(async (seed) => {
+        for (let attempt = 0; attempt < pollAttempts; attempt++) {
+          await new Promise((r) => setTimeout(r, pollDelayMs));
+          const readBack = seed.surface === "document" ? await ctxClient.documents.getDocument({ id: seed.id }) : await ctxClient.records.getRecord({ id: seed.id });
+          if (readBack.indexStatus === "FAILED") {
+            noteIfIndexFailed(readBack, seed, seed.surface);
+            return;
+          }
+          if (readBack.indexStatus !== "PENDING_INDEX") return;
+        }
+      })
+    );
+  }
   return {
     contextId: blueprint.contextId,
     servicePrincipalUserId: userId,
@@ -15577,6 +15664,11 @@ function buildClaudeCodeAddCommand(entry, serverKey = "vectros") {
   const envFlags = Object.entries(entry.env ?? {}).map(([k, v]) => `-e ${k}=${v}`);
   return ["claude", "mcp", "add", serverKey, ...envFlags, "--", entry.command, ...entry.args].join(" ");
 }
+function buildRestartHint(blueprintName, isCode) {
+  const target = isCode ? "Reopen Claude Code in this project" : "Restart your MCP client";
+  return `  ${target}, then ask Claude about your '${blueprintName}' data.
+`;
+}
 function mergeServerEntry(existing, entry, serverKey = "vectros") {
   const base = existing ? { ...existing } : {};
   const servers = { ...base.mcpServers ?? {} };
@@ -15916,11 +16008,19 @@ var CryptoFileSecretStore = class {
    * sub-millisecond in practice; the budget is generous for a loaded machine)
    * before deciding it is a crash remnant. A SHORT-but-nonempty winner is never
    * a write in flight — the 16 salt bytes land in one write — so it is refused
-   * immediately, exactly like the top-of-function read's twin check.
+   * immediately, exactly like the top-of-function read's twin check. A winner
+   * that goes MISSING mid-poll (ENOENT) restarts creation from the top rather
+   * than surfacing the raw ENOENT — see the catch below.
    */
   async adoptSalt(saltPath) {
     for (let attempt = 0; ; attempt++) {
-      const winner = await import_node_fs3.promises.readFile(saltPath);
+      let winner;
+      try {
+        winner = await import_node_fs3.promises.readFile(saltPath);
+      } catch (err) {
+        if (err.code === "ENOENT") return this.readOrCreateSalt();
+        throw err;
+      }
       if (winner.length >= 16) return winner;
       if (winner.length > 0) throw corruptSaltError(saltPath, winner.length);
       if (attempt >= 24) break;
@@ -17759,7 +17859,7 @@ function applyOutcomeSummary(result) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
     reconcileTally(result.roleActions, "role"),
-    // #1023 — the platform's PUT /v1/auth/issuers/{issuerId} makes an issuer's
+    // The platform's issuer partial-update endpoint makes an issuer's
     // 'reconciled' mean the same "updated to match" as every other kind here.
     reconcileTally(result.issuerActions, "issuer"),
     namespaceTally(result.namespaceActions),
@@ -18150,11 +18250,7 @@ ${renderPlan(blueprint, planSteps)}
       confirmExistingPrincipal,
       log
     });
-    const resolvedBlueprint = await resolveIdentities(
-      blueprint,
-      provisioned.ctxBootstrapClient ?? client,
-      log
-    );
+    const resolvedBlueprint = await resolveIdentities(blueprint, provisioned, client, log);
     const machineId = await resolveMachineId();
     const result = await loader(client, {
       blueprint: resolvedBlueprint,
@@ -18162,7 +18258,6 @@ ${renderPlan(blueprint, planSteps)}
       machineId,
       rotate: args.rotate,
       skipSeed: noSeed,
-      allowTenantWideNamespaces: args.allowTenantWideNamespaces,
       readExistingKey,
       persistMintedKey,
       provisioned,
@@ -18173,7 +18268,6 @@ ${renderPlan(blueprint, planSteps)}
         tenant: args.tenant,
         mintContext
       }),
-      confirmExistingPrincipal,
       log
     });
     process.stdout.write(
@@ -18229,10 +18323,13 @@ ${codeAddHint}`);
     }
     try {
       const merged = await safeMergeConfigFile({ configPath, entry });
-      const restartHint = isCode ? '  Reopen Claude Code in this project, then try: "list my tasks" / "add a task to \u2026"\n' : '  Restart your MCP client, then try: "list my tasks" / "add a task to \u2026"\n';
+      const restartHint = buildRestartHint(blueprint.name, isCode);
       process.stdout.write(
         `  \u2714 Config ${merged.action}${merged.backupPath ? ` (backup: ${merged.backupPath})` : ""}
-` + restartHint
+` + restartHint + // The `claude mcp add` line is otherwise only shown on --no-merge / a
+        // declined / a failed merge — surface it here too so a successful
+        // auto-merge doesn't hide the idiomatic install command entirely.
+        codeAddHint
       );
     } catch (err) {
       process.stderr.write(`  \u26A0 Could not merge config (${err instanceof Error ? err.message : String(err)}).
@@ -18416,8 +18513,12 @@ function compositeLegFindings(schema, lf, fieldsById, rangeEnabledFieldNames) {
 function lintBlueprint(bp) {
   const findings = [];
   const typeNames = /* @__PURE__ */ new Set();
+  const expectedDimsByTypeName = /* @__PURE__ */ new Map();
   for (const schema of bp.schemas) {
     typeNames.add(schema.typeName);
+    if (schema.expectedScopeDims && schema.expectedScopeDims.length > 0) {
+      expectedDimsByTypeName.set(schema.typeName, schema.expectedScopeDims);
+    }
     const fieldIds = /* @__PURE__ */ new Set();
     const fieldsById = /* @__PURE__ */ new Map();
     for (const f of schema.fields) {
@@ -18498,6 +18599,9 @@ function lintBlueprint(bp) {
   if (bp.accessProfile.allowedActions !== void 0) {
     const reached = ownerScopedReachWithoutDataScope(bp.accessProfile.allowedActions, ds);
     if (reached.length > 0) findings.push(unconstrainedReachFinding("accessProfile", reached));
+    findings.push(
+      ...partialCoverageFindings("accessProfile", bp.accessProfile.allowedActions, ds, expectedDimsByTypeName)
+    );
   }
   for (const roleId of Object.keys(bp.roles ?? {})) {
     if (!ROLE_ID_RE.test(roleId)) {
@@ -18515,6 +18619,9 @@ function lintBlueprint(bp) {
       if (reached.length > 0) {
         findings.push(unconstrainedReachFinding(`role '${roleId}' clause ${i}`, reached));
       }
+      findings.push(
+        ...partialCoverageFindings(`role '${roleId}' clause ${i}`, clause.allowedActions, cds, expectedDimsByTypeName)
+      );
       if (!cds) return;
       for (const [key, values] of Object.entries(cds)) {
         for (const value of values) {
@@ -18591,6 +18698,32 @@ function unconstrainedReachFinding(where, resources) {
     message: `${where}: no dataScope at all, but allowedActions grants r/u/d on ${resources.join("/")} \u2014 this reaches EVERY row of EVERY owner on ${resources.length > 1 ? "those resources" : "that resource"}, not just "your own org" or any other value you may have intended. If that's deliberate (a genuinely shared/tenant-wide resource), you can ignore this; otherwise add a dataScope entry.`
   };
 }
+function dimToDataScopeKey(dim) {
+  return dim === "userId" ? "userId" : `scope:${dim}`;
+}
+function partialCoverageFindings(where, allowedActions, dataScope, expectedDimsByTypeName) {
+  const findings = [];
+  const dataScopeKeys = new Set(Object.keys(dataScope ?? {}));
+  for (const action of allowedActions) {
+    const parts = action.split(":");
+    const [resource, ops] = parts;
+    if (resource !== "records" && resource !== "documents" || !ops) continue;
+    const qualifier = parts.length > 2 ? parts.slice(2).join(":") : void 0;
+    if (qualifier === void 0) continue;
+    const dims = expectedDimsByTypeName.get(qualifier);
+    if (!dims || dims.length === 0) continue;
+    if (!(ops === "*" || [...ops].some((op) => op === "r" || op === "u" || op === "d"))) continue;
+    const covered = dims.filter((d) => dataScopeKeys.has(dimToDataScopeKey(d)));
+    if (covered.length === 0 || covered.length === dims.length) continue;
+    const missing = dims.filter((d) => !covered.includes(d));
+    findings.push({
+      severity: "warning",
+      rule: "partial-datascope-dimension-coverage",
+      message: `${where}: ${action} covers dataScope dim${covered.length > 1 ? "s" : ""} [${covered.join(", ")}] of '${qualifier}'s declared expectedScopeDims [${dims.join(", ")}] \u2014 the ${missing.join("/")} dimension${missing.length > 1 ? "s are" : " is"} UNCONSTRAINED for this grant (every value reaches, not just the one(s) you may have intended). If that's deliberate, you can ignore this; otherwise add a dataScope entry for the missing dimension(s).`
+    });
+  }
+  return findings;
+}
 function lintPasses(findings) {
   return !findings.some((f) => f.severity === "error");
 }
@@ -18682,6 +18815,10 @@ function buildScaffold(name, from) {
 }
 
 // src/cli-blueprint.ts
+function noEffectOnBlueprint(flag, sub) {
+  const cmd = sub ? `blueprint ${sub}` : "blueprint";
+  return `'${flag}' has no effect on '${cmd}' \u2014 blueprint validate/plan/list/init are creds-free and never call the API, so there's no environment/credential to select. Did you mean 'vectros bootstrap'?`;
+}
 function parseBlueprintArgs(argv) {
   const args = { help: false, force: false, set: [] };
   const positionals = [];
@@ -18708,6 +18845,9 @@ function parseBlueprintArgs(argv) {
         args.values = argv[++i];
         break;
       default:
+        if (AUTH_FLAG_NAMES.includes(a)) {
+          throw new Error(noEffectOnBlueprint(a, positionals[0]));
+        }
         if (a.startsWith("-")) throw new Error(`Unknown blueprint flag: ${a}`);
         positionals.push(a);
     }
@@ -19500,6 +19640,51 @@ ${list}
   });
 }
 
+// src/dev-api.ts
+var DeveloperApiError = class extends Error {
+  statusCode;
+  constructor(message, statusCode) {
+    super(message);
+    this.name = "DeveloperApiError";
+    this.statusCode = statusCode;
+  }
+};
+async function fetchDeveloperUsersPage(opts) {
+  const { cognitoToken, apiBaseUrl, tenant, startFrom, limit, fetchImpl = fetch } = opts;
+  const base = apiBaseUrl.replace(/\/$/, "");
+  let url = `${base}/developer/users?tenant=${encodeURIComponent(tenant)}`;
+  if (startFrom) url += `&startFrom=${encodeURIComponent(startFrom)}`;
+  if (limit !== void 0) url += `&limit=${encodeURIComponent(String(limit))}`;
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${cognitoToken}` }
+    });
+  } catch (err) {
+    throw new DeveloperApiError(
+      `Request to /developer/users failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    const hint = res.status === 403 ? " (this command requires an account owner login \u2014 sign in as the owner and retry)" : "";
+    throw new DeveloperApiError(
+      `GET /developer/users failed: HTTP ${res.status}${hint}${body ? ` \u2014 ${body}` : ""}`,
+      res.status
+    );
+  }
+  let parsed;
+  try {
+    parsed = await res.json();
+  } catch {
+    throw new DeveloperApiError("GET /developer/users returned a non-JSON body");
+  }
+  const data = Array.isArray(parsed.data) ? parsed.data : [];
+  const nextCursor = typeof parsed.nextCursor === "string" ? parsed.nextCursor : null;
+  return { data, nextCursor };
+}
+
 // src/commands/identity.ts
 function isUserDimension(type) {
   return type === "user";
@@ -19654,6 +19839,57 @@ async function runIdentityList(opts, deps = {}) {
     }
   });
 }
+function toIdentityView(row) {
+  const str = (v) => typeof v === "string" ? v : void 0;
+  return {
+    id: str(row.id),
+    externalId: str(row.externalId),
+    email: str(row.email),
+    status: str(row.status),
+    type: str(row.type),
+    createdAt: str(row.createdAt)
+  };
+}
+async function runIdentityListAll(opts, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    try {
+      const tenant = opts.tenant ?? "live";
+      const fetchPage = async (startFrom) => {
+        const page = await fetchDeveloperUsersPage({
+          cognitoToken: auth.cognitoToken,
+          apiBaseUrl: auth.baseUrl,
+          tenant,
+          startFrom,
+          limit: opts.limit,
+          fetchImpl
+        });
+        return { data: page.data.map(toIdentityView), nextCursor: page.nextCursor };
+      };
+      let rows = opts.limit !== void 0 ? (await fetchPage()).data ?? [] : await drainPages(fetchPage);
+      if (opts.externalId) rows = rows.filter((r) => r.externalId === opts.externalId);
+      if (opts.json) {
+        process.stdout.write(`${formatJson(rows)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        "\n" + formatTable(rows, [
+          { header: "id", get: (r) => r.id },
+          { header: "external id", get: (r) => r.externalId },
+          { header: "email", get: (r) => r.email },
+          { header: "kind", get: (r) => r.type },
+          { header: "status", get: (r) => r.status }
+        ]) + "\n"
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(`  \u2716 identity list-all failed: ${formatError(err)}
+`);
+      return 1;
+    }
+  });
+}
 async function runIdentityGet(opts, deps = {}) {
   return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
@@ -20257,6 +20493,16 @@ async function runRoleCreate(opts, deps = {}) {
       dataScope = parseJsonObjectFlag("--data-scope", opts.dataScope);
     } catch (err) {
       process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+      return 2;
+    }
+  }
+  let assumable;
+  if (opts.assumable !== void 0) {
+    try {
+      assumable = parseJsonObjectFlag("--assumable", opts.assumable);
+    } catch (err) {
+      process.stderr.write(`  \u2716 ${formatError(err)}
 `);
       return 2;
     }
@@ -20274,7 +20520,12 @@ async function runRoleCreate(opts, deps = {}) {
           // stays byte-identical for unscoped roles.
           scopes: [
             dataScope ? { allowed_actions: actions, data_scope: dataScope } : { allowed_actions: actions }
-          ]
+          ],
+          // Included only when supplied — omitting it (rather than sending an
+          // empty object) keeps "no assume grant" and "explicitly empty grant"
+          // indistinguishable on the wire, matching the platform's own
+          // "omit for the safe default" contract.
+          assumable
         }
       });
       if (opts.json) {
@@ -20514,6 +20765,19 @@ ${renderContext(ctx)}
 }
 
 // src/commands/issuers.ts
+var readline4 = __toESM(require("readline/promises"));
+function parseSelfSignupPolicies(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  return raw.map((entry) => {
+    const sep = entry.indexOf(":");
+    if (sep <= 0 || sep === entry.length - 1) {
+      throw new Error(
+        `--self-signup-policy must be '<signup_type>:<roleId>' (e.g. 'default:member'); got '${entry}'.`
+      );
+    }
+    return { signup_type: entry.slice(0, sep), role_id: entry.slice(sep + 1) };
+  });
+}
 function renderSelfSignup(policies) {
   if (!policies || policies.length === 0) return "\u2014";
   return policies.map((p) => `${p.signup_type} \u2192 ${p.role_id}`).join(", ");
@@ -20581,6 +20845,308 @@ ${renderIssuer(issuer)}
     }
   });
 }
+async function runIssuersRegister(opts, deps = {}) {
+  let selfSignupPolicies;
+  try {
+    selfSignupPolicies = parseSelfSignupPolicies(opts.selfSignupPolicy);
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const issuer = await client.auth.registerIssuer({
+        issuerId: opts.issuerId,
+        issuer: opts.issuer,
+        jwksUri: opts.jwksUri,
+        audience: opts.audience,
+        contextId: opts.context,
+        subClaim: opts.subClaim,
+        emailClaim: opts.emailClaim,
+        userinfoUri: opts.userinfoUri,
+        selfSignupPolicies
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(issuer)}
+`);
+        return 0;
+      }
+      const verb = issuer.created === false ? "already registered \u2014 returned unchanged" : "registered";
+      process.stdout.write(`
+  \u2714 issuer '${opts.issuerId}' ${verb}
+${renderIssuer(issuer)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "issuers register failed" }));
+      return 1;
+    }
+  });
+}
+async function runIssuersUpdate(opts, deps = {}) {
+  let selfSignupPolicies;
+  try {
+    selfSignupPolicies = parseSelfSignupPolicies(opts.selfSignupPolicy);
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
+  if (opts.clearSelfSignupPolicies && selfSignupPolicies && selfSignupPolicies.length > 0) {
+    process.stderr.write(
+      "  \u2716 --clear-self-signup-policies and --self-signup-policy are mutually exclusive.\n"
+    );
+    return 2;
+  }
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const issuer = await client.auth.updateIssuer({
+        issuerId: opts.issuerId,
+        subClaim: opts.subClaim,
+        emailClaim: opts.emailClaim,
+        userinfoUri: opts.userinfoUri,
+        status: opts.status,
+        selfSignupPolicies: opts.clearSelfSignupPolicies ? [] : selfSignupPolicies
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(issuer)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 issuer '${opts.issuerId}' updated
+${renderIssuer(issuer)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "issuers update failed" }));
+      return 1;
+    }
+  });
+}
+async function runIssuersDelete(opts, deps = {}) {
+  const { issuerId, context } = opts;
+  if (!opts.force) {
+    const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+    if (!isTty) {
+      process.stderr.write(
+        `  \u2716 issuers delete is destructive and needs an interactive confirmation.
+    Re-run with --force to delete '${issuerId}' without a prompt.
+`
+      );
+      return 2;
+    }
+    const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
+      const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
+      return { prompt: (q) => rl.question(q), close: () => rl.close() };
+    })();
+    try {
+      process.stdout.write(
+        `
+  \u26A0 Deregistering issuer '${issuerId}' from context '${context}' removes it as a token-exchange
+    trust anchor. The platform refuses this while any user was ever created or matched
+    through it \u2014 deactivate those users or register a replacement issuer first if you
+    intend to cut off access.
+
+`
+      );
+      const typed = await promptCtx.prompt(`  Type the issuer id ('${issuerId}') to confirm: `);
+      if (typed.trim() !== issuerId) {
+        process.stderr.write(`  \u2716 Confirmation did not match \u2014 nothing deleted.
+`);
+        return 1;
+      }
+    } finally {
+      promptCtx.close();
+    }
+  }
+  return withAuth({ ...opts, provisioning: true, context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      await client.auth.deleteIssuer({ issuerId });
+      if (opts.json) {
+        process.stdout.write(`${formatJson({ issuerId, deleted: true })}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 issuer '${issuerId}' deregistered from '${context}'
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "issuers delete failed" }));
+      return 1;
+    }
+  });
+}
+
+// src/commands/namespace.ts
+function renderNamespace(n) {
+  return formatKeyValues([
+    ["namespace", n.namespace],
+    ["contextId", n.contextId ?? "(tenant-wide)"],
+    ["entityBacked", n.entityBacked === void 0 ? void 0 : String(n.entityBacked)],
+    ["reserved", n.reserved === void 0 ? void 0 : String(n.reserved)],
+    ["specificityRank", n.specificityRank === void 0 ? void 0 : String(n.specificityRank)],
+    ["defaultSchemaId", n.defaultSchemaId],
+    ["createdAt", n.createdAt]
+  ]);
+}
+async function runNamespaceList(opts, deps = {}) {
+  return withAuth({ ...opts, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const rows = await drainPages(
+        (startFrom) => client.identity.listNamespaces({
+          limit: PAGE_LIMIT,
+          ...opts.context ? { contextId: opts.context } : {},
+          ...startFrom ? { startFrom } : {}
+        })
+      );
+      if (opts.json) {
+        process.stdout.write(`${formatJson(rows)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        "\n" + formatTable(rows, [
+          { header: "namespace", get: (n) => n.namespace },
+          { header: "contextId", get: (n) => n.contextId ?? "(tenant-wide)" },
+          {
+            header: "entityBacked",
+            get: (n) => n.entityBacked === void 0 ? void 0 : String(n.entityBacked)
+          },
+          {
+            header: "specificityRank",
+            get: (n) => n.specificityRank === void 0 ? void 0 : String(n.specificityRank)
+          }
+        ]) + "\n"
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "namespace list failed" }));
+      return 1;
+    }
+  });
+}
+async function runNamespaceGet(opts, deps = {}) {
+  return withAuth({ ...opts, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const ns = await client.identity.getNamespace({
+        namespace: opts.namespace,
+        ...opts.context ? { contextId: opts.context } : {}
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(ns)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+${renderNamespace(ns)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "namespace get failed" }));
+      return 1;
+    }
+  });
+}
+async function runNamespaceRegister(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const ns = await client.identity.registerNamespace({
+        contextId: opts.context,
+        body: {
+          namespace: opts.namespace,
+          specificityRank: opts.specificityRank,
+          entityBacked: opts.entityBacked,
+          defaultSchemaId: opts.defaultSchemaId
+        }
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(ns)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 namespace '${opts.namespace}' registered
+${renderNamespace(ns)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "namespace register failed" }));
+      return 1;
+    }
+  });
+}
+
+// src/commands/assume.ts
+function parseAssumeScopes(raw) {
+  const out = {};
+  for (const entry of raw) {
+    const sep = entry.indexOf(":");
+    if (sep <= 0 || sep === entry.length - 1) {
+      throw new Error(`--scope must be '<namespace>:<value>' (e.g. 'org:orgB'); got '${entry}'.`);
+    }
+    const ns = entry.slice(0, sep);
+    const value = entry.slice(sep + 1);
+    const valueError = valueGrammarError(value);
+    if (valueError) throw new Error(`--scope value ${valueError}`);
+    const key = `scope:${ns}`;
+    if (Object.prototype.hasOwnProperty.call(out, key)) {
+      throw new Error(`--scope names namespace '${ns}' more than once \u2014 pass one value per namespace.`);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function renderAssumeToken(t) {
+  return formatKeyValues([
+    ["access_token", t.access_token],
+    ["token_type", t.token_type],
+    ["expires_in", t.expires_in === void 0 ? void 0 : `${t.expires_in}s`]
+  ]);
+}
+async function runAssume(opts, deps = {}) {
+  if (!opts.scope || opts.scope.length === 0) {
+    process.stderr.write("  \u2716 --scope must be given at least once (e.g. --scope org:orgB).\n");
+    return 2;
+  }
+  let scopes;
+  try {
+    scopes = parseAssumeScopes(opts.scope);
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
+  return withAuth({ ...opts, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const result = await client.auth.assumeToken(scopes);
+      if (opts.json) {
+        process.stdout.write(`${formatJson(result)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        `
+  \u2714 assumed ${Object.keys(scopes).join(", ")}
+${renderAssumeToken(result)}
+`
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "assume failed" }));
+      return 1;
+    }
+  });
+}
 
 // src/commands/login.ts
 var import_node_http = require("http");
@@ -21045,7 +21611,8 @@ async function runBlueprintHarness(client, input, deps) {
   });
   const blueprint = await resolveApplyTimeIdentities(
     input.blueprint,
-    provisioned.ctxBootstrapClient ?? client,
+    provisioned,
+    client,
     log
   );
   const remint = remintForContext ?? (async () => client);
@@ -21458,9 +22025,9 @@ function emitJoined(opts) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.19.0" : "dev",
-  sdk: true ? "0.41.0" : "dev",
-  blueprints: true ? "0.16.0" : "dev"
+  cli: true ? "0.20.0" : "dev",
+  sdk: true ? "0.42.0" : "dev",
+  blueprints: true ? "0.17.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -21541,10 +22108,22 @@ function buildProgram(deps = {}) {
   registerRoleCommands(program, deps);
   registerContextCommands(program, deps);
   registerIssuersCommands(program, deps);
+  registerNamespaceCommands(program, deps);
+  registerAssumeCommand(program, deps);
   registerJoinCommand(program, deps);
   registerKeyringCommands(program);
   return program;
 }
+function registerAssumeCommand(program, deps) {
+  const assume = program.command("assume").description("Re-mint your own verb token with one or more identity.<namespace> values switched (needs a role's assumable grant).").requiredOption("--context <c>", "app context to operate in").option("--scope <ns:value>", "namespace value to assume, repeatable (e.g. org:orgB)", collect, []);
+  addCommonAuthOptions(assume).action(
+    async (flags) => {
+      process.exit(
+        await runAssume({ ...toCommonOptions(flags), context: flags.context, scope: flags.scope ?? [] }, deps)
+      );
+    }
+  );
+}
 function registerJoinCommand(program, deps) {
   const join3 = program.command("join").description("Enroll a principal in a context (grant + key) and keep the key in the keyring.").argument("<context>", "the app context to join").option("--role <roleId>", "reference a Role to grant (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions to grant, comma-separated (XOR --role)").option("--as <principal>", "who to enroll: 'me' (default) or an explicit 'usr_<id>'", "me").option("--scope <ns:value>", "identity override: a scope the member acts under (repeatable, e.g. org:<id>)", collect, []).option("--alias <name>", "keyring entry name (defaults to the context id)").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option(
     "--activate",
@@ -21681,7 +22260,7 @@ function registerContextCommands(program, deps) {
   );
 }
 function registerIssuersCommands(program, deps) {
-  const issuers = program.command("issuers").description("Inspect registered third-party IdP issuers (token-exchange trust anchors).");
+  const issuers = program.command("issuers").description("Manage registered third-party IdP issuers (token-exchange trust anchors).");
   const list = issuers.command("list").description("List issuers registered in one app context.").requiredOption("--context <c>", "app context the issuer(s) are registered under").option("--tenant <tenant>", "tenant to read: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(
     async (flags) => {
@@ -21700,12 +22279,125 @@ function registerIssuersCommands(program, deps) {
       );
     }
   );
+  const register = issuers.command("register").description("Register (idempotent by issuerId) a trusted third-party IdP issuer.").requiredOption("--context <c>", "app context an exchanged token targets").requiredOption("--issuer-id <id>", "short slug for this issuer (3-31 chars; lowercase letter + lowercase/digit/dash)").requiredOption("--issuer <url>", "the IdP's iss claim value").requiredOption("--jwks-uri <url>", "the IdP's remote JWKS endpoint").requiredOption("--audience <aud>", "the required aud claim value (globally unique with --issuer)").option("--sub-claim <claim>", "claim carrying the subject identifier (default 'sub')").option("--email-claim <claim>", "claim carrying the subject's email (default 'email')").option("--userinfo-uri <url>", "OIDC userinfo endpoint, used as an email-resolution fallback").option(
+    "--self-signup-policy <type:roleId>",
+    "opt-in self-service signup entry, repeatable (e.g. default:member) \u2014 no entry may target an elevated role",
+    collect,
+    []
+  ).option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(register).action(
+    async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(
+        await runIssuersRegister(
+          {
+            ...toCommonOptions(flags),
+            context: flags.context,
+            issuerId: flags.issuerId,
+            issuer: flags.issuer,
+            jwksUri: flags.jwksUri,
+            audience: flags.audience,
+            subClaim: flags.subClaim,
+            emailClaim: flags.emailClaim,
+            userinfoUri: flags.userinfoUri,
+            selfSignupPolicy: flags.selfSignupPolicy,
+            tenant
+          },
+          deps
+        )
+      );
+    }
+  );
+  const update = issuers.command("update").description("Patch the safe, mutable fields of a registered issuer (trust-anchor fields are immutable).").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--sub-claim <claim>", "update the subject-identifier claim").option("--email-claim <claim>", "update the subject-email claim").option("--userinfo-uri <url>", "update the OIDC userinfo fallback endpoint").option("--status <status>", "'active' or 'suspended' \u2014 a suspended issuer's tokens are rejected at exchange time").option(
+    "--self-signup-policy <type:roleId>",
+    "replace self-signup policies, repeatable (e.g. default:member) \u2014 omit entirely to leave unchanged",
+    collect,
+    []
+  ).option("--clear-self-signup-policies", "disable self-signup entirely (sends an empty list; XOR --self-signup-policy)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(update).action(
+    async (issuerId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(
+        await runIssuersUpdate(
+          {
+            ...toCommonOptions(flags),
+            context: flags.context,
+            issuerId,
+            subClaim: flags.subClaim,
+            emailClaim: flags.emailClaim,
+            userinfoUri: flags.userinfoUri,
+            status: flags.status,
+            selfSignupPolicy: flags.selfSignupPolicy,
+            clearSelfSignupPolicies: Boolean(flags.clearSelfSignupPolicies),
+            tenant
+          },
+          deps
+        )
+      );
+    }
+  );
+  const del = issuers.command("delete").description("Deregister a trusted third-party IdP issuer (refused while any user is bound through it).").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--force", "skip the interactive confirmation (required when stdin is not a TTY)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(del).action(
+    async (issuerId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(
+        await runIssuersDelete(
+          { ...toCommonOptions(flags), context: flags.context, issuerId, force: Boolean(flags.force), tenant },
+          deps
+        )
+      );
+    }
+  );
+}
+function registerNamespaceCommands(program, deps) {
+  const namespace = program.command("namespace").description("Manage scope-namespace registrations (whether scope:<namespace> values resolve to identity entities).");
+  const register = namespace.command("register").description("Register a new scope namespace (NOT idempotent \u2014 a repeat name 400s).").argument("<name>", "namespace name: 2-32 chars, a lowercase letter first, then lowercase/digit/dash/underscore").requiredOption("--context <c>", "app context to own this registration").requiredOption("--specificity-rank <n>", "position in the account specificity order (integer 0-1000000, unique)").option("--entity-backed", "values must resolve to an identity entity (create via `identity create --type <name>`)").option("--default-schema-id <id>", "default record schema bound to entities in this namespace");
+  addCommonAuthOptions(register).action(
+    async (name, flags) => {
+      const specificityRank = Number(flags.specificityRank);
+      if (!Number.isInteger(specificityRank) || specificityRank < 0 || specificityRank > 1e6) {
+        process.stderr.write(
+          `  \u2716 --specificity-rank must be an integer between 0 and 1000000 (got '${flags.specificityRank}').
+`
+        );
+        process.exit(2);
+      }
+      process.exit(
+        await runNamespaceRegister(
+          {
+            ...toCommonOptions(flags),
+            namespace: name,
+            context: flags.context,
+            specificityRank,
+            entityBacked: Boolean(flags.entityBacked),
+            defaultSchemaId: flags.defaultSchemaId
+          },
+          deps
+        )
+      );
+    }
+  );
+  const list = namespace.command("list").description("List scope-namespace registrations \u2014 tenant-wide, or one context\u2019s own.").option("--context <c>", "list one app context\u2019s own registrations instead of the tenant-wide set");
+  addCommonAuthOptions(list).action(async (flags) => {
+    process.exit(await runNamespaceList({ ...toCommonOptions(flags), context: flags.context }, deps));
+  });
+  const get = namespace.command("get").description("Show one namespace registration \u2014 tenant-wide, or one context\u2019s own.").argument("<name>").option("--context <c>", "resolve for one app context\u2019s own registration instead of the tenant-wide one");
+  addCommonAuthOptions(get).action(
+    async (name, flags) => {
+      process.exit(
+        await runNamespaceGet({ ...toCommonOptions(flags), namespace: name, context: flags.context }, deps)
+      );
+    }
+  );
 }
 function registerRoleCommands(program, deps) {
   const role = program.command("role").description("Manage context-scoped roles (reusable scope rules; bind via `access grant --role`).");
   const create = role.command("create").description("Create (idempotent by roleId) a single-clause role from --actions.").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id (3-31 chars; lowercase letter + lowercase/digit/dash)").requiredOption("--name <name>", "human-readable name").requiredOption("--actions <csv>", "allowed actions, comma-separated (e.g. records:cru,search:r)").option(
     "--data-scope <json>",
     `confine the clause to owned data \u2014 JSON map of dimension \u2192 allowed values, e.g. '{"userId":["\${{ self.userId }}"]}' or '{"scope:org":["<orgId>", null]}'`
+  ).option(
+    "--assumable <json>",
+    `role-level \`vectros assume\` grant \u2014 JSON map of scope:<namespace> \u2192 allowed values (e.g. '{"scope:org":["orgB"]}'); independent of --data-scope, never data_scope's grammar (userId cannot be named)`
   ).option("--description <text>", "free-text description");
   addCommonAuthOptions(create).action(
     async (flags) => {
@@ -21717,6 +22409,7 @@ function registerRoleCommands(program, deps) {
           name: flags.name,
           actions: flags.actions,
           dataScope: flags.dataScope,
+          assumable: flags.assumable,
           description: flags.description
         }, deps)
       );
@@ -21810,6 +22503,20 @@ function registerIdentityCommands(program, deps) {
       );
     }
   );
+  const listAll = identity.command("list-all").description(
+    "List every user in the tenant (owner login required), bypassing the app-context confinement 'identity list' is subject to \u2014 for recovering a user created but never granted access anywhere, which 'identity list' can never show."
+  ).option("--external-id <id>", "filter to a stable id").option("--limit <n>", "page size (1\u2013100)", (v) => Number.parseInt(v, 10)).option("--tenant <tenant>", "tenant to list: 'test' or 'live' (default live)");
+  addCommonAuthOptions(listAll).action(
+    async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      process.exit(
+        await runIdentityListAll(
+          { ...toCommonOptions(flags), externalId: flags.externalId, limit: flags.limit, tenant },
+          deps
+        )
+      );
+    }
+  );
   const get = identity.command("get").description("Show one principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id (from create/list)");
   addCommonAuthOptions(get).action(async (flags) => {
     process.exit(await runIdentityGet({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps));