@vectros-ai/cli 0.20.0 → 0.21.0

package/dist/cli.mjs

@@ -526,8 +526,8 @@ var require_graceful_fs = __commonJS({
       fs5.createReadStream = createReadStream;
       fs5.createWriteStream = createWriteStream;
       var fs$readFile = fs5.readFile;
-      fs5.readFile = readFile3;
-      function readFile3(path4, options, cb) {
+      fs5.readFile = readFile4;
+      function readFile4(path4, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path4, options, cb);
@@ -1619,7 +1619,7 @@ var require_proper_lockfile = __commonJS({
 // src/cli-bootstrap.ts
 import * as readline2 from "readline/promises";
 
-// node_modules/@vectros-ai/sdk/dist/index.mjs
+// ../../node_modules/@vectros-ai/sdk/dist/index.mjs
 var __defProp2 = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -1653,6 +1653,7 @@ __export(api_exports, {
   FieldDef: () => FieldDef,
   FileUploadRequest: () => FileUploadRequest,
   ForbiddenError: () => ForbiddenError,
+  GatewayTimeoutError: () => GatewayTimeoutError,
   IdentityLookupRequest: () => IdentityLookupRequest,
   IndexFailure: () => IndexFailure,
   InternalServerError: () => InternalServerError,
@@ -1677,9 +1678,12 @@ __export(api_exports, {
   SearchRequest: () => SearchRequest,
   SearchResult: () => SearchResult,
   SearchResultsEvent: () => SearchResultsEvent,
+  ServiceUnavailableError: () => ServiceUnavailableError,
   TooManyRequestsError: () => TooManyRequestsError,
+  TriggerFailureResponse: () => TriggerFailureResponse,
   TruncationWarningEvent: () => TruncationWarningEvent,
   UnauthorizedError: () => UnauthorizedError,
+  UnprocessableEntityError: () => UnprocessableEntityError,
   UserExistsResponse: () => UserExistsResponse,
   UserRequest: () => UserRequest,
   UserResponse: () => UserResponse,
@@ -1691,7 +1695,9 @@ __export(api_exports, {
   inference: () => inference_exports,
   records: () => records_exports,
   schemas: () => schemas_exports,
-  search: () => search_exports
+  scripts: () => scripts_exports,
+  search: () => search_exports,
+  triggers: () => triggers_exports
 });
 var toJson = (value, replacer, space) => {
   return JSON.stringify(value, replacer, space);
@@ -1811,6 +1817,21 @@ var ForbiddenError = class extends VectrosError {
     this.name = this.constructor.name;
   }
 };
+var GatewayTimeoutError = class extends VectrosError {
+  constructor(body, rawResponse) {
+    super({
+      message: "GatewayTimeoutError",
+      statusCode: 504,
+      body,
+      rawResponse
+    });
+    Object.setPrototypeOf(this, new.target.prototype);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+    this.name = this.constructor.name;
+  }
+};
 var InternalServerError = class extends VectrosError {
   constructor(body, rawResponse) {
     super({
@@ -1871,6 +1892,21 @@ var PaymentRequiredError = class extends VectrosError {
     this.name = this.constructor.name;
   }
 };
+var ServiceUnavailableError = class extends VectrosError {
+  constructor(body, rawResponse) {
+    super({
+      message: "ServiceUnavailableError",
+      statusCode: 503,
+      body,
+      rawResponse
+    });
+    Object.setPrototypeOf(this, new.target.prototype);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+    this.name = this.constructor.name;
+  }
+};
 var TooManyRequestsError = class extends VectrosError {
   constructor(body, rawResponse) {
     super({
@@ -1901,6 +1937,21 @@ var UnauthorizedError = class extends VectrosError {
     this.name = this.constructor.name;
   }
 };
+var UnprocessableEntityError = class extends VectrosError {
+  constructor(body, rawResponse) {
+    super({
+      message: "UnprocessableEntityError",
+      statusCode: 422,
+      body,
+      rawResponse
+    });
+    Object.setPrototypeOf(this, new.target.prototype);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+    this.name = this.constructor.name;
+  }
+};
 var auth_exports = {};
 var ErasureRequest;
 ((ErasureRequest2) => {
@@ -1990,6 +2041,7 @@ var LookupRecordsRequestOrder = {
   Desc: "desc"
 };
 var schemas_exports = {};
+var scripts_exports = {};
 var SearchRequest;
 ((SearchRequest2) => {
   SearchRequest2.Mode = {
@@ -2015,6 +2067,7 @@ var search_exports = {};
 __export(search_exports, {
   SearchRequest: () => SearchRequest
 });
+var triggers_exports = {};
 var AccessProfileRequest;
 ((AccessProfileRequest2) => {
   AccessProfileRequest2.Status = {
@@ -2044,7 +2097,9 @@ var BatchWriteResult;
     Created: "created",
     Updated: "updated",
     Conflict: "conflict",
-    Invalid: "invalid"
+    Invalid: "invalid",
+    Forbidden: "forbidden",
+    NotCommitted: "not_committed"
   };
 })(BatchWriteResult || (BatchWriteResult = {}));
 var ChatMessage;
@@ -2348,13 +2403,23 @@ var SearchResultsEvent;
     SearchResults: "search_results"
   };
 })(SearchResultsEvent || (SearchResultsEvent = {}));
+var TriggerFailureResponse;
+((TriggerFailureResponse2) => {
+  TriggerFailureResponse2.Event = {
+    Create: "CREATE",
+    Update: "UPDATE",
+    Delete: "DELETE"
+  };
+})(TriggerFailureResponse || (TriggerFailureResponse = {}));
 var TruncationWarningEvent;
 ((TruncationWarningEvent2) => {
   TruncationWarningEvent2.Event = {
     TruncationWarning: "truncation_warning"
   };
   TruncationWarningEvent2.Reason = {
-    ContextWindowBudget: "context_window_budget"
+    ContextWindowBudget: "context_window_budget",
+    NoGroundableContent: "no_groundable_content",
+    ContextWindowBudgetAndNoContent: "context_window_budget_and_no_content"
   };
 })(TruncationWarningEvent || (TruncationWarningEvent = {}));
 var UserExistsResponse;
@@ -2369,8 +2434,7 @@ var UserRequest;
 ((UserRequest2) => {
   UserRequest2.Status = {
     Active: "ACTIVE",
-    Suspended: "SUSPENDED",
-    Pending: "PENDING"
+    Suspended: "SUSPENDED"
   };
   UserRequest2.Type = {
     Human: "HUMAN",
@@ -3838,6 +3902,16 @@ function mergeHeaders(...headersArray) {
   }
   return result;
 }
+function mergeOnlyDefinedHeaders(...headersArray) {
+  const result = {};
+  for (const [key, value] of headersArray.filter((headers) => headers != null).flatMap((headers) => Object.entries(headers))) {
+    const insensitiveKey = key.toLowerCase();
+    if (value != null) {
+      result[insensitiveKey] = value;
+    }
+  }
+  return result;
+}
 function normalizeClientOptions(options) {
   const headers = mergeHeaders(
     {
@@ -4108,7 +4182,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/admin/keys/scoped");
   }
   /**
-   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. Minting a key bound to your OWN principal needs nothing further; minting one bound to a DIFFERENT principal additionally requires the `delegate-mint` capability (`granted_capabilities`) on your credential — without it the request is refused. A root API key (`sk_`) is exempt from all three bounds.
+   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. Minting a key bound to your OWN principal needs nothing further; minting one bound to a DIFFERENT principal additionally requires the `delegate-mint` capability (`granted_capabilities`) on your credential — without it the request is refused. A root API key (`sk_`) is exempt from all three bounds. The profile you name must be `active` AND the user you name must not be `SUSPENDED`: either is refused with `409`, and no root exemption applies to that. Both refusals stop ISSUANCE only. Suspending the profile additionally stops credentials already bound to it, within about five minutes; suspending the user does not stop their existing keys at all. A `PENDING` user is fine.
    *
    * @param {Vectros.CreateScopedKeyRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4116,6 +4190,7 @@ var AuthClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -4164,6 +4239,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -4575,7 +4652,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/app-contexts");
   }
   /**
-   * Creates a new app context. This call is idempotent by `contextId`: if an app context with the same `contextId` already exists, the existing app context is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing context was returned) tells the two apart. To overwrite an existing context's `name`/`description` instead of returning it unchanged, set `?upsert=true` (this also requires the `app-contexts:u` scope). The reserved `contextId` value `vectros-admin` cannot be created through this endpoint; it is provisioned automatically for your account. Requires the `app-contexts:c` scope.
+   * Creates a new app context. This call is idempotent by `contextId`: if an app context with the same `contextId` already exists, the existing app context is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing context was returned) tells the two apart. To overwrite an existing context's `name`/`description`/`companyName` instead of returning it unchanged, set `?upsert=true` (this also requires the `app-contexts:u` scope). The reserved `contextId` value `vectros-admin` cannot be created through this endpoint; it is provisioned automatically for your account. Requires the `app-contexts:c` scope.
    *
    * @param {Vectros.CreateAppContextRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5059,7 +5136,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/app-contexts/{contextId}");
   }
   /**
-   * Updates the name and/or description of an app context. This is a partial update: any field you omit (or send as null) keeps its existing value. The `contextId` is immutable and is taken from the URL path, so any `contextId` in the request body is ignored. Requires the `app-contexts:u` scope.
+   * Updates the name, description, and/or companyName of an app context. This is a partial update: any field you omit (or send as null) keeps its existing value. The `contextId` is immutable and is taken from the URL path, so any `contextId` in the request body is ignored. Requires the `app-contexts:u` scope.
    *
    * @param {Vectros.UpdateAppContextRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5541,7 +5618,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access. **A token confined to a single app context sees only that context's usage**: totals, the environment split, and the `contexts` breakdown narrow to it, and the environment your context is not bound to is omitted (`null`), not zeroed. Only a token with cross-context reach sees your full account-wide totals. Two exceptions to the narrowing, since they have no per-context breakdown to narrow to: `reads.calls.used`/`reads.dataOut.bytes` (metered per account, not per context) read as `0` for a confined token rather than a narrowed figure — the corresponding overage-credit charge fields narrow correctly; and `credits.limit` stays your whole plan's ceiling, so `credits.remaining` may overstate the account's true remaining room.
+   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, records, and trigger-script execution time) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access. **A token confined to a single app context sees only that context's usage**: totals, the environment split, and the `contexts` breakdown narrow to it, and the environment your context is not bound to is omitted (`null`), not zeroed. Only a token with cross-context reach sees your full account-wide totals. Two exceptions to the narrowing, since they have no per-context breakdown to narrow to: `reads.calls.used`/`reads.dataOut.bytes` (metered per account, not per context) read as `0` for a confined token rather than a narrowed figure — the corresponding overage-credit charge fields narrow correctly; and `credits.limit` stays your whole plan's ceiling, so `credits.remaining` may overstate the account's true remaining room. The `execution` section narrows correctly for a confined token, like the other per-context charge fields — but note its credits carry sub-credit remainders forward across your whole account for the period, so compare `execution.creditsMilli` against your account-wide figure rather than recomputing it from one context's `billableMillis`.
    *
    * @param {Vectros.GetUsageRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7675,7 +7752,7 @@ var FoldersClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/folders/{id}");
   }
   /**
-   * Permanently deletes a folder. The folder must be empty (contain no documents or sub-folders) and must not be protected. Your context's root folder is protected and cannot be deleted. Requires the `folders:d` scope.
+   * Permanently deletes a folder. The folder must be empty — it must contain no documents, no records, and no sub-folders — and must not be protected. Your context's root folder is protected and cannot be deleted. Requires the `folders:d` scope.
    *
    * @param {Vectros.DeleteFolderRequest} request
    * @param {FoldersClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8084,11 +8161,12 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/entities/{namespace}/{id}");
   }
   /**
-   * Updates the mutable fields of an entity. Omitted fields are preserved (a null value does not clear a field), and the `payload` object is replaced in full when supplied. Providing `scopes` replaces the entity's parent edges. Requires the `entities:u:<namespace>` scope.
+   * Updates the mutable fields of an entity. Omitted fields are preserved (a null value does not clear a field), and the `payload` object is replaced in full when supplied. Providing `scopes` replaces the entity's parent edges. Supplying a different `externalId` re-points the entity's identifier; it must still be unused in this namespace and app context. Requires the `entities:u:<namespace>` scope.
    *
    * @param {Vectros.UpdateEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
@@ -8138,6 +8216,8 @@ var IdentityClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
@@ -9362,7 +9442,7 @@ var InferenceClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/documents/{id}/ask");
   }
   /**
-   * Runs hybrid search over your indexed content, then streams a model answer grounded in the top results. The SSE stream emits a `search_results` event first (carrying the matched results and their metadata), an optional `truncation_warning` if lower-scoring results were dropped to fit the model's context window, then `content_delta` chunks, and finally a terminal `done` event. Requires the `inference:r` scope.
+   * Runs hybrid search over your indexed content, then streams a model answer grounded in the top results. The SSE stream emits a `search_results` event first (carrying the matched results and their metadata), an optional `truncation_warning` if some retrieved results were dropped before the prompt was built — either because they didn't fit the model's context window or because a result had no groundable text to include — then `content_delta` chunks, and finally a terminal `done` event. Requires the `inference:r` scope.
    */
   ragInference(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__ragInference(request, requestOptions));
@@ -9557,14 +9637,18 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/records/lookup/batch");
   }
   /**
-   * Reserved endpoint for bulk record writes. The published response shape includes a per-item partial-failure envelope and an atomicity flag. It currently returns 501 (not implemented). The documented 200 response schema is the stable shape this endpoint will use once available, published now so SDK integrations against it will not break when it ships. Requires the `records:c` scope.
+   * Writes up to 50 records (or 50 with `atomicity: all_or_nothing`) in a single request. Each item in `items` has exactly the same shape, and goes through exactly the same validation, authorization and idempotency rules, as the body of a single `POST /v1/records` — including schema validation, `externalId` idempotency, unique-field enforcement, and the `records:c:<type>` scope check, which is applied per item against that item's own record type. A batch is not a way to write a type your credential could not write one at a time.
+   *
+   * `atomicity` selects how the batch commits. `best_effort` (the default) writes each item independently: some can succeed while others fail, and each item's own outcome is reported. `all_or_nothing` commits every item in one transaction — if any item fails, no record is created or updated at all, and every item that was itself fine reports `not_committed` while the ones that failed report why. Because the transaction is bounded by the number of underlying storage rows rather than by the number of records, a large `all_or_nothing` batch can be refused as too large to commit atomically even when it is within the item limit; the error says so, and nothing is written when it happens.
+   *
+   * The response is HTTP 200 whenever the batch was processed at all — including when every item failed — so always inspect `results` rather than relying on the status code. Match each result to the item you sent using its `index`. Requires the `records:c` scope.
    *
    * @param {Vectros.BatchWriteRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.TooManyRequestsError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.records.batchWriteRecords()
@@ -9573,6 +9657,11 @@ var RecordsClient = class {
     return HttpResponsePromise.fromPromise(this.__batchWriteRecords(request, requestOptions));
   }
   async __batchWriteRecords(request = {}, requestOptions) {
+    const { upsert, allowClear, ..._body } = request;
+    const _queryParams = {
+      upsert,
+      allowClear
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -9587,9 +9676,9 @@ var RecordsClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
-      body: request,
+      body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -9601,12 +9690,12 @@ var RecordsClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -10509,7 +10598,7 @@ var SchemasClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/schemas/{id}");
   }
   /**
-   * Updates a record schema. Fields you omit are preserved; `typeName` is immutable and cannot be changed. Collection fields (`fields`, `lookupFields`, `renderHints`, `capabilities`) are replaced in full when supplied. Requires the `schemas:u` scope.
+   * Updates a record schema. Fields you omit are preserved; `typeName` is immutable and cannot be changed. Collection fields (`fields`, `lookupFields`, `renderHints`, `capabilities`) are replaced in full when supplied. Because `capabilities` is replaced in full, omitting `triggersEnabled` clears it — the request is refused with 409 if that would disable triggers while trigger rules still fire off this schema, so delete those rules first. Requires the `schemas:u` scope.
    *
    * @param {Vectros.UpdateSchemaRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10517,6 +10606,7 @@ var SchemasClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -10568,6 +10658,8 @@ var SchemasClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -10581,7 +10673,7 @@ var SchemasClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/schemas/{id}");
   }
   /**
-   * Permanently deletes a record schema. The request is refused with 409 if records of this type still exist — delete those records first, since every record must reference a live schema. A lineage base (a schema other schemas declare `basedOn`) also cannot be deleted while any such variant still exists — delete the variant schema(s) first. Requires the `schemas:d` scope.
+   * Permanently deletes a record schema. The request is refused with 409 if records of this type still exist — delete those records first, since every record must reference a live schema. A lineage base (a schema other schemas declare `basedOn`) also cannot be deleted while any such variant still exists — delete the variant schema(s) first. It is likewise refused while any trigger rule fires off this schema — delete those trigger rules first. Requires the `schemas:d` scope.
    *
    * @param {Vectros.DeleteSchemaRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10703,46 +10795,70 @@ var SchemasClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/schemas/{id}/versions");
   }
 };
-var SearchClient = class {
+var ScriptsClient = class {
   constructor(options) {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Runs a hybrid, semantic, or text search across the content you have indexed. By default it returns both documents and records in a single unified result set; pass `contentTypes` to narrow the results (for example `["documents"]`). Each result carries a `sourceType` discriminator (`PartnerDocument` or `GenericRecord`) so you can branch on the type. Requires the `search:r` scope.
+   * Runs a script you previously pushed to `POST /v1/scripts`, under your own credential, and returns what it returned. Every write the script makes is buffered and committed as ONE transaction after the script finishes: either all of them land or none do, and the response is sent only after they have committed — so everything in `result` is committed state or the script's own computation over it. On any failure the body is the standard error envelope and nothing the script staged is committed: its rows are written only when the transaction commits, and a document body or a large payload is DECIDED at that point and WRITTEN to storage only after the commit, so an aborted execution leaves nothing behind. The one residual sits after a successful commit, outside this response: if storing a body fails then, the row exists and the body does not until the platform's repair lands — so a `200` guarantees the rows, and a document's text should be read before it is relied on.
    *
-   * @param {Vectros.SearchRequest} request
-   * @param {SearchClient.RequestOptions} requestOptions - Request-specific configuration.
+   * **Permission.** Requires the `scripts:x` scope — the permission to *execute* — separate from the `scripts:c` permission to push scripts. Bare `scripts:x` grants every script in the context; `scripts:x:<name>` grants exactly that script name, every version of it. Execution discloses no source, so `scripts:r` is not needed. Inside the script, every read and write is enforced by your credential's data scopes exactly as the equivalent REST call would be — `scripts:x` alone can read and write nothing.
+   *
+   * **Input.** Your script sees `input.event` (the literal `"execute"`), `input.userId` (your credential's user id, or null), and `input.params` (the `input` object you sent, verbatim). That is the same `input` grammar a trigger rule uses, so one script can serve both by branching on `input.event`. `params` is not validated — a script that needs a shape checks for it and throws; the script's `declaredInputContract` is documentation for readers and is not enforced.
+   *
+   * **Budget.** Seconds of useful work: the script has 15 s of wall clock (never more than 16) and a bounded number of statements and host calls; a runaway script is stopped early with `RESOURCE_LIMIT_EXCEEDED`. The transaction is bounded by the number of underlying storage rows it writes — 100 rows after merging — rather than by the number of entities: creating a folder costs 3 rows; creating a plain text document or a record costs 1 row plus one per range-indexed lookup field plus one per `reference` field. So "create a folder and file N documents" holds up to 97 plain documents, 48 with one range field or one reference, 32 with both; if a script exceeds the limit the error says so (`WRITE_BUFFER_CAP_EXCEEDED`, with `total` and `limit`) and nothing is committed. This request takes the write-path limits (burst, credit ceiling, principal quota) once, before the script runs — there is no free-read allowance here, so an account over its credit ceiling is refused even for a read-only script. Reads the script performs are metered as reads, writes as writes, and execution time beyond what those operations include is charged as script execution time (see `GET /v1/usage`).
+   *
+   * **Reads inside the script.** A `get` sees the script's own staged writes. A list, query or lookup never shows a row the script has deleted, shows a row it re-saved with the updated content, and does not yet show a row it created — you hold that row's id from `create()`.
+   *
+   * **Retries.** Send an optional `Idempotency-Key` header (1–128 characters of letters, digits, `.`, `_`, `:` or `-`) to make a retry safe: a request repeated under the same key within 24 hours receives the same response as the first attempt without executing again — when that first attempt SUCCEEDED (a duplicate still in flight is refused with `409 IDEMPOTENCY_IN_PROGRESS`; the same key on a different request is refused with `422 IDEMPOTENCY_KEY_REUSED`). A first attempt that FAILED with any other status is not remembered: the same key is free to try again, so a retry after a `400` or a `429` executes. If an execution's outcome cannot be determined — the script did not finish inside the budget while its writes may have committed — the response is `500 EXECUTION_OUTCOME_UNKNOWN` carrying `execution.id`, and a keyed retry receives that same answer: inspect what the script would have written, then use a NEW key for a new attempt. When a key is present the serialised `result` is capped at 16 KB instead of 256 KB. Without a key, a lost response cannot be distinguished from a failed one; re-read before retrying.
+   *
+   * @param {Vectros.ScriptExecuteRequest} request
+   * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.PaymentRequiredError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
+   * @throws {@link Vectros.ContentTooLargeError}
+   * @throws {@link Vectros.UnprocessableEntityError}
    * @throws {@link Vectros.TooManyRequestsError}
+   * @throws {@link Vectros.InternalServerError}
+   * @throws {@link Vectros.ServiceUnavailableError}
+   * @throws {@link Vectros.GatewayTimeoutError}
    *
    * @example
-   *     await client.search.content({
-   *         query: "patient intake form diabetes"
+   *     await client.scripts.executeScript({
+   *         "Idempotency-Key": "order-8412-attempt",
+   *         scriptRef: {
+   *             name: "notify-assignee",
+   *             version: "3"
+   *         }
    *     })
    */
-  content(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__content(request, requestOptions));
+  executeScript(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__executeScript(request, requestOptions));
   }
-  async __content(request, requestOptions) {
+  async __executeScript(request, requestOptions) {
+    const { "Idempotency-Key": idempotencyKey, ..._body } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
       this._options?.headers,
+      mergeOnlyDefinedHeaders({ "Idempotency-Key": idempotencyKey }),
       requestOptions?.headers
     );
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/search"
+        "v1/scripts/execute"
       ),
       method: "POST",
       headers: _headers,
       contentType: "application/json",
       queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
-      body: request,
+      body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -10756,10 +10872,26 @@ var SearchClient = class {
       switch (_response.error.statusCode) {
         case 400:
           throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 402:
+          throw new PaymentRequiredError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
+        case 413:
+          throw new ContentTooLargeError(_response.error.body, _response.rawResponse);
+        case 422:
+          throw new UnprocessableEntityError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        case 500:
+          throw new InternalServerError(_response.error.body, _response.rawResponse);
+        case 503:
+          throw new ServiceUnavailableError(_response.error.body, _response.rawResponse);
+        case 504:
+          throw new GatewayTimeoutError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -10768,71 +10900,834 @@ var SearchClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/search");
-  }
-};
-var VectrosClient = class {
-  constructor(options) {
-    this._options = normalizeClientOptionsWithAuth(options);
-  }
-  get auth() {
-    return this._auth ?? (this._auth = new AuthClient(this._options));
-  }
-  get documents() {
-    return this._documents ?? (this._documents = new DocumentsClient(this._options));
-  }
-  get identity() {
-    return this._identity ?? (this._identity = new IdentityClient(this._options));
-  }
-  get compliance() {
-    return this._compliance ?? (this._compliance = new ComplianceClient(this._options));
-  }
-  get folders() {
-    return this._folders ?? (this._folders = new FoldersClient(this._options));
-  }
-  get inference() {
-    return this._inference ?? (this._inference = new InferenceClient(this._options));
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/scripts/execute");
   }
-  get records() {
-    return this._records ?? (this._records = new RecordsClient(this._options));
-  }
-  get schemas() {
-    return this._schemas ?? (this._schemas = new SchemasClient(this._options));
+  /**
+   * Returns a paginated list of your scripts. Pass `name` to list every version of one script name (oldest first); omit it for a flat list across every name in your account (newest first). Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `scripts:r` scope.
+   *
+   * @param {Vectros.ListScriptsRequest} request
+   * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @example
+   *     await client.scripts.listScripts({
+   *         name: "notify-assignee",
+   *         startFrom: "b3BhcXVlLWN1cnNvci1mcm9tLXRoZS1wcmV2aW91cy1wYWdl"
+   *     })
+   */
+  listScripts(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listScripts(request, requestOptions));
   }
-  get search() {
-    return this._search ?? (this._search = new SearchClient(this._options));
+  async __listScripts(request = {}, requestOptions) {
+    const { name, startFrom, limit } = request;
+    const _queryParams = {
+      name,
+      startFrom,
+      limit
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/scripts"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      throw new VectrosError({
+        statusCode: _response.error.statusCode,
+        body: _response.error.body,
+        rawResponse: _response.rawResponse
+      });
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/scripts");
   }
   /**
-   * Make a passthrough request using the SDK's configured auth, retry, logging, etc.
-   * This is useful for making requests to endpoints not yet supported in the SDK.
-   * The input can be a URL string, URL object, or Request object. Relative paths are resolved against the configured base URL.
+   * Stores a new version of a script object. Every POST creates a genuinely new version — this is NOT idempotent-by-name: pushing `name` again always creates a new row with `scriptVersion` auto-incremented (the first version pushed for a name is 1). `source` is stored as-is: nothing parses or validates it at push time. A version runs when a trigger rule references it (`POST /v1/triggers`) or when `POST /v1/scripts/execute` names it. Requires the `scripts:c` scope.
    *
-   * @param {Request | string | URL} input - The URL, path, or Request object.
-   * @param {RequestInit} init - Standard fetch RequestInit options.
-   * @param {core.PassthroughRequest.RequestOptions} requestOptions - Per-request overrides (timeout, retries, headers, abort signal).
-   * @returns {Promise<Response>} A standard Response object.
+   * @param {Vectros.ScriptRequest} request
+   * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.ConflictError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.scripts.createScript({
+   *         name: "notify-assignee",
+   *         source: "export default function(input) { return { ok: true }; }"
+   *     })
    */
-  async fetch(input, init, requestOptions) {
-    return makePassthroughRequest(
-      input,
-      init,
-      {
-        baseUrl: this._options.baseUrl ?? this._options.environment,
-        headers: this._options.headers,
-        timeoutInSeconds: this._options.timeoutInSeconds,
-        maxRetries: this._options.maxRetries,
-        fetch: this._options.fetch,
-        logging: this._options.logging,
-        getAuthHeaders: async () => (await this._options.authProvider.getAuthRequest()).headers
-      },
-      requestOptions
+  createScript(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__createScript(request, requestOptions));
+  }
+  async __createScript(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
     );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/scripts"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/scripts");
   }
-};
-var logging;
-((logging2) => {
-  logging2.LogLevel = LogLevel;
-  logging2.ConsoleLogger = ConsoleLogger;
+  /**
+   * Retrieves a single script version by its ID. Requires the `scripts:r` scope.
+   *
+   * @param {Vectros.GetScriptRequest} request
+   * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.NotFoundError}
+   *
+   * @example
+   *     await client.scripts.getScript({
+   *         id: "id"
+   *     })
+   */
+  getScript(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getScript(request, requestOptions));
+  }
+  async __getScript(request, requestOptions) {
+    const { id } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/scripts/${url_exports.encodePathParam(id)}`
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/scripts/{id}");
+  }
+  /**
+   * Scripts are immutable per version; this endpoint always returns a 400 regardless of scope or credential — push a new version via `POST /v1/scripts` instead.
+   *
+   * @param {Vectros.UpdateScriptRequest} request
+   * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.scripts.updateScript({
+   *         id: "id",
+   *         body: {
+   *             name: "notify-assignee",
+   *             source: "export default function(input) { return { ok: true }; }"
+   *         }
+   *     })
+   */
+  updateScript(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateScript(request, requestOptions));
+  }
+  async __updateScript(request, requestOptions) {
+    const { id, body: _body } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/scripts/${url_exports.encodePathParam(id)}`
+      ),
+      method: "PUT",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: _body,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: void 0, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/scripts/{id}");
+  }
+  /**
+   * Permanently deletes one script version by ID. Deleting one version does not affect any other version of the same name. Requires the `scripts:d` scope.
+   *
+   * @param {Vectros.DeleteScriptRequest} request
+   * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.scripts.deleteScript({
+   *         id: "id"
+   *     })
+   */
+  deleteScript(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteScript(request, requestOptions));
+  }
+  async __deleteScript(request, requestOptions) {
+    const { id } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/scripts/${url_exports.encodePathParam(id)}`
+      ),
+      method: "DELETE",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: void 0, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/scripts/{id}");
+  }
+};
+var SearchClient = class {
+  constructor(options) {
+    this._options = normalizeClientOptionsWithAuth(options);
+  }
+  /**
+   * Runs a hybrid, semantic, or text search across the content you have indexed. By default it returns both documents and records in a single unified result set; pass `contentTypes` to narrow the results (for example `["documents"]`). Each result carries a `sourceType` discriminator (`PartnerDocument` or `GenericRecord`) so you can branch on the type. Requires the `search:r` scope.
+   *
+   * @param {Vectros.SearchRequest} request
+   * @param {SearchClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.search.content({
+   *         query: "patient intake form diabetes"
+   *     })
+   */
+  content(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__content(request, requestOptions));
+  }
+  async __content(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/search"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/search");
+  }
+};
+var TriggersClient = class {
+  constructor(options) {
+    this._options = normalizeClientOptionsWithAuth(options);
+  }
+  /**
+   * Returns a page of trigger executions that failed — what went wrong, whether the platform will retry it, and which of your records and rules were involved. Use this to find automation that has stopped running.
+   *
+   * A record appears once per FIRING, not once per attempt: if the platform retries a retryable failure, the same record's `attempts` count rises rather than a new record appearing. **If a retry later succeeds, the record is removed** — so this endpoint describes what is currently broken, not a permanent history. Records also expire 30 days after the firing first failed.
+   *
+   * `detail` is safe to surface to your own users: it carries only your own content (a script's own thrown message) or public API vocabulary, never platform internals. For `INTERNAL_ERROR` it is absent and a `correlationId` is returned instead — quote that to support.
+   *
+   * Scoped to your account and app context, derived from your token — never from input. Requires the `triggers:r` scope.
+   *
+   * @param {Vectros.ListTriggerFailuresRequest} request
+   * @param {TriggersClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @example
+   *     await client.triggers.listTriggerFailures({
+   *         ruleId: "3b1c9f2e7a5d8410f6c2e9a1b7d4038f5e6a91c2d7f0b3a4586c9e2f1d0a7b3c",
+   *         category: "SCRIPT_ERROR",
+   *         startFrom: "b3BhcXVlLWN1cnNvci1mcm9tLXRoZS1wcmV2aW91cy1wYWdl"
+   *     })
+   */
+  listTriggerFailures(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listTriggerFailures(request, requestOptions));
+  }
+  async __listTriggerFailures(request = {}, requestOptions) {
+    const { ruleId, category, retryable, from: from_, to, startFrom, limit } = request;
+    const _queryParams = {
+      ruleId,
+      category,
+      retryable,
+      from: from_,
+      to,
+      startFrom,
+      limit
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/trigger-failures"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      throw new VectrosError({
+        statusCode: _response.error.statusCode,
+        body: _response.error.body,
+        rawResponse: _response.rawResponse
+      });
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/trigger-failures");
+  }
+  /**
+   * Returns a paginated list of your trigger rules, newest first. Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `triggers:r` scope.
+   *
+   * @param {Vectros.ListTriggersRequest} request
+   * @param {TriggersClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @example
+   *     await client.triggers.listTriggers({
+   *         startFrom: "b3BhcXVlLWN1cnNvci1mcm9tLXRoZS1wcmV2aW91cy1wYWdl"
+   *     })
+   */
+  listTriggers(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listTriggers(request, requestOptions));
+  }
+  async __listTriggers(request = {}, requestOptions) {
+    const { startFrom, limit } = request;
+    const _queryParams = {
+      startFrom,
+      limit
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/triggers"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      throw new VectrosError({
+        statusCode: _response.error.statusCode,
+        body: _response.error.body,
+        rawResponse: _response.rawResponse
+      });
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/triggers");
+  }
+  /**
+   * Declares a new trigger rule, or (with `?upsert=true`) reconciles an existing one of the same name to the submitted shape. Once declared, the rule fires: a record write on the named schema dispatches the referenced script, which runs asynchronously under this rule's own grant. Because that grant is executed, a scoped credential may not declare a trigger whose grant exceeds its own — such a request is rejected with a `403`, and a `roleIds` entry that does not resolve in this context with a `400`. Requires the `triggers:c` scope (also `triggers:u` when `?upsert=true` matches an existing row).
+   *
+   * @param {Vectros.CreateTriggerRequest} request
+   * @param {TriggersClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.triggers.createTrigger({
+   *         body: {
+   *             name: "on-intake-create",
+   *             firingSource: {
+   *                 schemaId: "sch_9f8e7d6c",
+   *                 event: "CREATE"
+   *             },
+   *             scriptRef: {
+   *                 name: "notify-assignee",
+   *                 version: "3"
+   *             }
+   *         }
+   *     })
+   */
+  createTrigger(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__createTrigger(request, requestOptions));
+  }
+  async __createTrigger(request, requestOptions) {
+    const { upsert, body: _body } = request;
+    const _queryParams = {
+      upsert
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/triggers"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: _body,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/triggers");
+  }
+  /**
+   * Retrieves a single trigger rule by its ID. Requires the `triggers:r` scope.
+   *
+   * @param {Vectros.GetTriggerRequest} request
+   * @param {TriggersClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.NotFoundError}
+   *
+   * @example
+   *     await client.triggers.getTrigger({
+   *         id: "id"
+   *     })
+   */
+  getTrigger(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getTrigger(request, requestOptions));
+  }
+  async __getTrigger(request, requestOptions) {
+    const { id } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/triggers/${url_exports.encodePathParam(id)}`
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/triggers/{id}");
+  }
+  /**
+   * Updates an existing trigger rule in place. The rule's resulting grant must be within your own granted scope — including a grant you did not change, because a trigger's other fields (its `scriptRef`, its `principalId`) determine what that grant executes. `name`, `principalId` and `provisionedBy` are immutable once set. Requires the `triggers:u` scope.
+   *
+   * @param {Vectros.UpdateTriggerRequest} request
+   * @param {TriggersClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.triggers.updateTrigger({
+   *         id: "id",
+   *         body: {
+   *             name: "on-intake-create",
+   *             firingSource: {
+   *                 schemaId: "sch_9f8e7d6c",
+   *                 event: "CREATE"
+   *             },
+   *             scriptRef: {
+   *                 name: "notify-assignee",
+   *                 version: "3"
+   *             }
+   *         }
+   *     })
+   */
+  updateTrigger(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateTrigger(request, requestOptions));
+  }
+  async __updateTrigger(request, requestOptions) {
+    const { id, body: _body } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/triggers/${url_exports.encodePathParam(id)}`
+      ),
+      method: "PUT",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: _body,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/triggers/{id}");
+  }
+  /**
+   * Permanently deletes one trigger rule by ID. Requires the `triggers:d` scope.
+   *
+   * @param {Vectros.DeleteTriggerRequest} request
+   * @param {TriggersClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.triggers.deleteTrigger({
+   *         id: "id"
+   *     })
+   */
+  deleteTrigger(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteTrigger(request, requestOptions));
+  }
+  async __deleteTrigger(request, requestOptions) {
+    const { id } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/triggers/${url_exports.encodePathParam(id)}`
+      ),
+      method: "DELETE",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: void 0, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/triggers/{id}");
+  }
+};
+var VectrosClient = class {
+  constructor(options) {
+    this._options = normalizeClientOptionsWithAuth(options);
+  }
+  get auth() {
+    return this._auth ?? (this._auth = new AuthClient(this._options));
+  }
+  get documents() {
+    return this._documents ?? (this._documents = new DocumentsClient(this._options));
+  }
+  get identity() {
+    return this._identity ?? (this._identity = new IdentityClient(this._options));
+  }
+  get compliance() {
+    return this._compliance ?? (this._compliance = new ComplianceClient(this._options));
+  }
+  get folders() {
+    return this._folders ?? (this._folders = new FoldersClient(this._options));
+  }
+  get inference() {
+    return this._inference ?? (this._inference = new InferenceClient(this._options));
+  }
+  get records() {
+    return this._records ?? (this._records = new RecordsClient(this._options));
+  }
+  get schemas() {
+    return this._schemas ?? (this._schemas = new SchemasClient(this._options));
+  }
+  get scripts() {
+    return this._scripts ?? (this._scripts = new ScriptsClient(this._options));
+  }
+  get search() {
+    return this._search ?? (this._search = new SearchClient(this._options));
+  }
+  get triggers() {
+    return this._triggers ?? (this._triggers = new TriggersClient(this._options));
+  }
+  /**
+   * Make a passthrough request using the SDK's configured auth, retry, logging, etc.
+   * This is useful for making requests to endpoints not yet supported in the SDK.
+   * The input can be a URL string, URL object, or Request object. Relative paths are resolved against the configured base URL.
+   *
+   * @param {Request | string | URL} input - The URL, path, or Request object.
+   * @param {RequestInit} init - Standard fetch RequestInit options.
+   * @param {core.PassthroughRequest.RequestOptions} requestOptions - Per-request overrides (timeout, retries, headers, abort signal).
+   * @returns {Promise<Response>} A standard Response object.
+   */
+  async fetch(input, init, requestOptions) {
+    return makePassthroughRequest(
+      input,
+      init,
+      {
+        baseUrl: this._options.baseUrl ?? this._options.environment,
+        headers: this._options.headers,
+        timeoutInSeconds: this._options.timeoutInSeconds,
+        maxRetries: this._options.maxRetries,
+        fetch: this._options.fetch,
+        logging: this._options.logging,
+        getAuthHeaders: async () => (await this._options.authProvider.getAuthRequest()).headers
+      },
+      requestOptions
+    );
+  }
+};
+var logging;
+((logging2) => {
+  logging2.LogLevel = LogLevel;
+  logging2.ConsoleLogger = ConsoleLogger;
 })(logging || (logging = {}));
 
 // ../blueprints/dist/index.mjs
@@ -10884,6 +11779,20 @@ var BlueprintFieldDefSchema = z.object({
   // the `s` reveal scope for this record type (SchemaRequest.FieldDef.sensitive).
   // Format passthrough — the loader forwards it to createSchema. Default false.
   sensitive: z.boolean().optional(),
+  // Keep this field on the RECORD ROW when the payload is stored out of line (a large record, or a
+  // LARGE_PAYLOAD storage profile), so it appears in list/lookup projections without
+  // `includePayload`.
+  //
+  // Load-bearing for triggers: a trigger rule's `fields` may name a field only if it is `inline`,
+  // `filterable`, or a lookup field — and never `sensitive`. So this is the flag that makes an
+  // otherwise-ordinary field projectable into a triggered script's `input.record`. Mutually
+  // exclusive with `sensitive` (the platform refuses the combination). The platform also refuses,
+  // with a 409, removing whatever keeps a field projectable while a live trigger rule still
+  // projects it — dropping `inline` OR `filterable` OR the lookup that carried it, not just this
+  // flag.
+  //
+  // Format passthrough — the loader forwards it to createSchema. Default false.
+  inline: z.boolean().optional(),
   // Reference-field surface — a typed foreign-key link to another record. The
   // platform (SchemaRequest.FieldDef) requires BOTH targetTypeName AND
   // targetSurface on a reference field; the blueprint format uses the SAME names
@@ -10906,6 +11815,13 @@ var BlueprintFieldDefSchema = z.object({
   targetSurface: z.string().min(1).optional(),
   cardinality: z.enum(["one", "many"]).optional()
 }).strict().superRefine((field, ctx) => {
+  if (field.inline === true && field.sensitive === true) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["inline"],
+      message: "a field cannot be both 'inline' and 'sensitive' \u2014 a sensitive field is blind-indexed and masked in responses, so it can never be projected into a trigger script; drop one of the two"
+    });
+  }
   const isReference = field.fieldType === "reference";
   const hasRefKeys = field.targetTypeName !== void 0 || field.targetField !== void 0 || field.targetSurface !== void 0 || field.cardinality !== void 0;
   if (isReference && field.targetTypeName === void 0) {
@@ -10999,7 +11915,8 @@ var BlueprintLookupFieldSchema = z.union([
   })
 ]);
 var BlueprintCapabilitiesSchema = z.object({
-  auditHistory: z.boolean().optional()
+  auditHistory: z.boolean().optional(),
+  triggersEnabled: z.boolean().optional()
 }).strict();
 var BlueprintSchemaSchema = z.object({
   typeName: z.string().min(1),
@@ -11107,6 +12024,30 @@ var GrantedCapabilitiesSchema = z.array(z.string().min(1)).optional().superRefin
     seen.add(name);
   });
 });
+var MAX_ASSIGNABLE_ROLES = 20;
+var ROLE_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
+var AssignableRolesSchema = z.array(
+  z.string().regex(ROLE_ID_RE, {
+    message: "an assignableRoles entry must be a roleId: 3-31 chars, a lowercase letter first, then lowercase letters/digits/dashes (e.g. 'case-handler')"
+  })
+).min(1, {
+  message: "assignableRoles must either be omitted (no roleId restriction) or name at least one roleId \u2014 an empty list states no rule"
+}).max(MAX_ASSIGNABLE_ROLES, {
+  message: `assignableRoles accepts at most ${MAX_ASSIGNABLE_ROLES} entries`
+}).optional().superRefine((roleIds, ctx) => {
+  if (!roleIds) return;
+  const seen = /* @__PURE__ */ new Set();
+  roleIds.forEach((rid, i) => {
+    if (seen.has(rid)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [i],
+        message: `assignableRoles names '${rid}' more than once \u2014 list it once`
+      });
+    }
+    seen.add(rid);
+  });
+});
 var BlueprintAccessProfileSchema = z.object({
   // Validated structurally here; the SCOPE GATE (in @vectros-ai/cli) is
   // what enforces the data-plane-only security boundary.
@@ -11176,7 +12117,14 @@ var BlueprintAccessProfileSchema = z.object({
   // blast-radius question from granting the same capability to a role that
   // a person is bound to. The gate should weigh the two separately rather
   // than reuse one policy for both.
-  capabilities: GrantedCapabilitiesSchema
+  capabilities: GrantedCapabilitiesSchema,
+  // Optional roleId allow-list on this profile's own inline clause — see
+  // {@link AssignableRolesSchema}. Allowed here for the same symmetry reason `capabilities` is:
+  // the platform models an access profile's scopes as a list of the SAME ScopeClause a role clause
+  // uses, and the loader already builds this profile as one such clause. Only meaningful when the
+  // clause grants role-composing authority in the first place (`profiles:c`-shaped); on a
+  // clause that grants none it is inert rather than an error, exactly as on the platform.
+  assignableRoles: AssignableRolesSchema
 }).strict().superRefine((ap, ctx) => {
   const hasInline = ap.allowedActions !== void 0;
   const hasRoleIds = ap.roleIds !== void 0;
@@ -11203,13 +12151,21 @@ var BlueprintAccessProfileSchema = z.object({
         message: "accessProfile.capabilities is not valid alongside 'roleIds' \u2014 a role-composed profile has no inline clause of its own; author capabilities on the referenced role's clause instead"
       });
     }
+    if (ap.assignableRoles !== void 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["assignableRoles"],
+        message: "accessProfile.assignableRoles is not valid alongside 'roleIds' \u2014 a role-composed profile has no inline clause of its own; author assignableRoles on the referenced role's clause instead"
+      });
+    }
   }
 });
 var BlueprintRoleClauseSchema = z.object({
   allowedActions: z.array(z.string().min(1)).min(1),
   dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
   dataScopeRef: z.string().min(1).optional(),
-  capabilities: GrantedCapabilitiesSchema
+  capabilities: GrantedCapabilitiesSchema,
+  assignableRoles: AssignableRolesSchema
 }).strict().superRefine((c, ctx) => {
   if (c.dataScope !== void 0 && c.dataScopeRef !== void 0) {
     ctx.addIssue({
@@ -11225,6 +12181,115 @@ var BlueprintFragmentsSchema = z.record(
 var BlueprintRolesSchema = z.record(z.array(BlueprintRoleClauseSchema).min(1));
 var BlueprintRoleAssumableSchema = z.record(z.array(z.string().min(1)).min(1));
 var BlueprintRoleAssumableMapSchema = z.record(BlueprintRoleAssumableSchema);
+var BlueprintTriggerFiringSourceSchema = z.object({
+  schemaName: z.string().min(1),
+  event: z.enum(["CREATE", "UPDATE", "DELETE"])
+}).strict();
+var SCRIPT_VERSION_INTEGER_RE = /^[1-9][0-9]*$/;
+var BlueprintTriggerScriptRefSchema = z.object({
+  name: z.string().min(1),
+  version: z.string().min(1)
+}).strict().superRefine((ref, ctx) => {
+  if (ref.version !== "latest" && !SCRIPT_VERSION_INTEGER_RE.test(ref.version)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["version"],
+      message: `scriptRef.version '${ref.version}' is invalid \u2014 must be a positive decimal integer (as a string, e.g. '3') or the literal 'latest'`
+    });
+  }
+});
+var MANIFEST_VERB_RE = /^[a-z]+(?:\.[a-z]+)+$/;
+var BlueprintTriggerManifestSchema = z.array(
+  z.string().min(1).regex(MANIFEST_VERB_RE, {
+    message: "a manifest entry must be '<noun>.<verb>' (e.g. 'records.update')"
+  })
+).optional();
+var BlueprintTriggerEntrySchema = z.object({
+  firingSource: BlueprintTriggerFiringSourceSchema,
+  scriptRef: BlueprintTriggerScriptRefSchema,
+  allowedActions: z.array(z.string().min(1)).min(1).optional(),
+  roleIds: z.array(z.string().min(1)).min(1).optional(),
+  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
+  capabilities: GrantedCapabilitiesSchema,
+  manifest: BlueprintTriggerManifestSchema,
+  /**
+   * REQUIRED. The record fields this rule projects into its script's `input.record` — and, on an
+   * UPDATE firing, `input.previous` (the same fields as they were before the write). On a DELETE
+   * firing `input.record` carries these fields from the deleted row, which is the only way a
+   * script can see anything of it.
+   *
+   * **An empty list is the "I project nothing" declaration**, not an omission: the script still
+   * receives `input.recordId`. It is required rather than defaulted precisely so that projecting
+   * nothing is something an author STATES, not something they get by forgetting the field.
+   *
+   * Every entry must name a field the schema keeps INLINE — declared `inline: true`, or
+   * `filterable`, or used as a lookup field (a leg of one, or its `sortBy` target) — and never one
+   * marked `sensitive`.
+   * `lintTriggerFields` checks that against the schema this blueprint declares; the platform
+   * checks it again, and refuses a schema update that would un-inline a field a live rule still
+   * projects.
+   *
+   * A field the record does not carry arrives as `undefined`, never null. `record` and `previous`
+   * together are capped at 224 KB serialised — a firing whose projected input exceeds that is not
+   * run, and is recorded as an `INPUT_TOO_LARGE` failure naming the size.
+   */
+  fields: z.array(z.string().min(1))
+}).strict().superRefine((entry, ctx) => {
+  const hasInline = entry.allowedActions !== void 0;
+  const hasRoleIds = entry.roleIds !== void 0;
+  if (hasInline === hasRoleIds) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["roleIds"],
+      message: hasInline ? "a trigger entry carries both 'allowedActions' and 'roleIds' \u2014 provide exactly one: an inline clause (allowedActions, optionally dataScope/capabilities) OR a role composition (roleIds), never both" : "a trigger entry carries neither 'allowedActions' nor 'roleIds' \u2014 provide exactly one: an inline clause (allowedActions, optionally dataScope/capabilities) OR a role composition (roleIds)"
+    });
+    return;
+  }
+  if (hasRoleIds) {
+    if (entry.dataScope !== void 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["dataScope"],
+        message: "a trigger entry's dataScope is not valid alongside 'roleIds' \u2014 a role-composed entry has no inline clause of its own; author dataScope on the referenced role's clause instead"
+      });
+    }
+    if (entry.capabilities !== void 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["capabilities"],
+        message: "a trigger entry's capabilities is not valid alongside 'roleIds' \u2014 a role-composed entry has no inline clause of its own; author capabilities on the referenced role's clause instead"
+      });
+    }
+  }
+});
+var BlueprintTriggersSchema = z.record(BlueprintTriggerEntrySchema);
+var SCRIPT_NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
+var SCRIPT_SOURCE_MAX_BYTES = 3e5;
+var SCRIPT_INPUT_CONTRACT_MAX_BYTES = 5e4;
+var utf8Bytes = (s) => new TextEncoder().encode(s).length;
+var BlueprintScriptEntrySchema = z.object({
+  /**
+   * The script's source text, shipped verbatim.
+   *
+   * NOTHING PARSES THIS — not this package, and not the platform, which stores it as-is. A syntax
+   * error is therefore invisible until the version first RUNS, where it surfaces as a
+   * `SCRIPT_ERROR` from the trigger rule that dispatched it. Validation here is limited to what
+   * can be checked without a JS parser: non-blank, and within the platform's byte cap.
+   */
+  source: z.string().refine((s) => s.trim().length > 0, { message: "'source' must not be blank" }).refine((s) => utf8Bytes(s) <= SCRIPT_SOURCE_MAX_BYTES, {
+    message: `'source' exceeds the platform's ${SCRIPT_SOURCE_MAX_BYTES.toLocaleString("en-US")}-byte cap (measured in UTF-8 bytes, not characters)`
+  }),
+  /**
+   * Optional free-text description of the input shape this script expects.
+   *
+   * DESCRIPTIVE ONLY — neither this package nor the platform validates a firing's input against
+   * it. It documents the contract for a human reading the blueprint; it does not enforce one.
+   */
+  declaredInputContract: z.string().min(1).refine((s) => utf8Bytes(s) <= SCRIPT_INPUT_CONTRACT_MAX_BYTES, {
+    message: `'declaredInputContract' exceeds the platform's ${SCRIPT_INPUT_CONTRACT_MAX_BYTES.toLocaleString("en-US")}-byte cap (measured in UTF-8 bytes, not characters)`
+  }).optional()
+}).strict();
+var BlueprintScriptsSchema = z.record(BlueprintScriptEntrySchema);
 var IDENTITY_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
 var FORBIDDEN_IDENTITY_NAMESPACES = /* @__PURE__ */ new Set(["record", "document", "entity", "user"]);
 var IdentityKindSchema = z.string().min(1).superRefine((val, ctx) => {
@@ -11259,6 +12324,24 @@ var BlueprintServicePrincipalSchema = z.object({
   displayName: z.string().min(1)
 }).strict();
 var ISSUER_ID_RE = CONTEXT_ID_RE;
+var MAX_CAPTURED_CLAIMS = 20;
+var MAX_CAPTURED_CLAIM_NAME_LENGTH = 64;
+function assertNoDuplicateClaimNames(field) {
+  return (claims, ctx) => {
+    if (!claims) return;
+    const seen = /* @__PURE__ */ new Set();
+    claims.forEach((name, i) => {
+      if (seen.has(name)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [i],
+          message: `${field} repeats '${name}' \u2014 each claim name may appear only once`
+        });
+      }
+      seen.add(name);
+    });
+  };
+}
 var BlueprintIssuerSchema = z.object({
   /** Short slug identifying this issuer within your account. Immutable once registered. */
   issuerId: z.string().regex(ISSUER_ID_RE, {
@@ -11313,7 +12396,36 @@ var BlueprintIssuerSchema = z.object({
         message: "roleId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'practitioner-member')"
       })
     }).strict()
-  ).optional()
+  ).optional(),
+  /**
+   * Opt-in ADDITIONAL identity-claim capture: OIDC claim names — beyond `emailClaim`, which keeps
+   * its own dedicated field — read from this issuer's tokens on every successful token exchange
+   * and stored as your tenant's golden IdP-asserted identity copy for the signed-in user.
+   *
+   * Deliberately NOT a fixed set: name whatever claims your IdP actually asserts (standard ones
+   * like `name`/`phone_number`, or your provider's own custom claims). Each name is read from the
+   * verified token first, falling back to `userinfoUri` (when configured) only for names still
+   * missing after that — so a claim your IdP puts only on the userinfo response still resolves,
+   * provided you configured that endpoint.
+   *
+   * Omit entirely to capture nothing beyond email (the default, and the behaviour of every
+   * registration authored before this field existed). Capped at 20 entries, each a non-blank name
+   * of at most 64 characters; a duplicate is REJECTED rather than silently deduplicated, because a
+   * repeated name is a sign the declaration does not mean what its author thinks.
+   *
+   * Pairs with the top-level `identityProjectionClaims`, which decides which of these captured
+   * names are then projected onto access profiles in this context — capture and projection are
+   * separate opt-ins, and capturing a claim does not by itself expose it on a profile.
+   */
+  capturedClaims: z.array(
+    z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
+      message: `a capturedClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
+    }).refine((name) => name.trim().length > 0, {
+      message: "a capturedClaims entry must be a non-blank OIDC claim name"
+    })
+  ).max(MAX_CAPTURED_CLAIMS, {
+    message: `capturedClaims accepts at most ${MAX_CAPTURED_CLAIMS} entries`
+  }).optional().superRefine(assertNoDuplicateClaimNames("capturedClaims"))
 }).strict();
 var BlueprintNamespaceSchema = z.object({
   /** The namespace to register — same grammar as a `scope:<namespace>` key. */
@@ -11518,21 +12630,35 @@ var BlueprintSeedRecordSchema = z.discriminatedUnion("surface", [
   RecordSeedSchema,
   DocumentSeedSchema
 ]);
-var SELF_TOKEN_RE = /\$\{\{\s*(?:self|under|member)\.[^}]*?\s*\}\}/;
+var SELF_TOKEN_RE = /\$\{\{\s*(?:self|under|member|input)\.[^}]*?\s*\}\}/;
+var IDENTITY_DERIVED_TOKEN_RE = /\$\{\{\s*(?:self|under|member)\.[^}]*?\s*\}\}/;
+var INPUT_TOKEN_RE = /\$\{\{\s*input\.[^}]*?\s*\}\}/;
 function lintSelfTokenPlacement(value, ctx) {
-  const walk = (node, path4, inRoleDataScope) => {
+  const walk = (node, path4, zone) => {
     if (typeof node === "string") {
-      if (!inRoleDataScope && SELF_TOKEN_RE.test(node)) {
+      if (zone === "none" && SELF_TOKEN_RE.test(node)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: path4,
+          message: "'${{ self.* }}' / '${{ member.* }}' / '${{ input.* }}' is a runtime placeholder \u2014 it is only valid inside a roles[].dataScope value, a roleAssumable[] value, a fragments[] value, or a triggers[].dataScope value ('${{ input.* }}' specifically is valid ONLY in triggers[].dataScope)"
+        });
+      } else if (zone === "trigger" && IDENTITY_DERIVED_TOKEN_RE.test(node)) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
           path: path4,
-          message: "'${{ self.* }}' / '${{ member.* }}' is a runtime placeholder \u2014 it is only valid inside a roles[].dataScope value, a roleAssumable[] value, or a fragments[] value"
+          message: "'${{ self.* }}' / '${{ under.self.* }}' / '${{ member.* }}' resolve against the TRIGGER PRINCIPAL's identity, not yours \u2014 a trigger's grant is resolved at fire time under its own principal. The platform refuses them in a trigger grant for that reason: the reach they describe is not bounded by your own. Use '${{ input.* }}' to confine the grant to the record that fired the rule, or name literal values."
+        });
+      } else if (zone === "self-family" && INPUT_TOKEN_RE.test(node)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: path4,
+          message: "'${{ input.* }}' resolves against the record that fired a trigger \u2014 it is only valid inside a triggers[].dataScope value. It is inert (never resolved, matches nothing) in roles[].dataScope, roleAssumable[], and fragments[] values; use '${{ self.* }}' / '${{ under.self.* }}' / '${{ member.* }}' there instead."
         });
       }
       return;
     }
     if (Array.isArray(node)) {
-      node.forEach((v, i) => walk(v, [...path4, i], inRoleDataScope));
+      node.forEach((v, i) => walk(v, [...path4, i], zone));
       return;
     }
     if (node && typeof node === "object") {
@@ -11540,12 +12666,13 @@ function lintSelfTokenPlacement(value, ctx) {
         const inRoleDataScopeClause = path4.length === 3 && path4[0] === "roles" && k === "dataScope";
         const inRoleAssumable = path4.length === 0 && k === "roleAssumable";
         const inFragments = path4.length === 0 && k === "fragments";
-        const entering = inRoleDataScope || inRoleDataScopeClause || inRoleAssumable || inFragments;
-        walk(v, [...path4, k], entering);
+        const inTriggerDataScope = path4.length === 2 && path4[0] === "triggers" && k === "dataScope";
+        const nextZone = zone === "trigger" || inTriggerDataScope ? "trigger" : zone === "self-family" || inRoleDataScopeClause || inRoleAssumable || inFragments ? "self-family" : "none";
+        walk(v, [...path4, k], nextZone);
       }
     }
   };
-  walk(value, [], false);
+  walk(value, [], "none");
 }
 var IDENTITY_REF_RE = /\$\{\{\s*identities\.([A-Za-z_]\w*)\s*\}\}/g;
 var IDENTITY_REF_LOOSE_RE = /\$\{\{\s*identities\.([^}]*?)\s*\}\}/g;
@@ -11699,6 +12826,44 @@ function lintDataScopeKey(key, path4, ctx) {
     });
   }
 }
+var RECORD_RESERVED_FILTERABLE_FIELD_IDS = /* @__PURE__ */ new Set([
+  "tenantId",
+  "owner_id",
+  "folderId",
+  "rootFolderId",
+  "recordType"
+]);
+var DOCUMENT_RESERVED_FILTERABLE_FIELD_IDS = /* @__PURE__ */ new Set([
+  "tenantId",
+  "model_type",
+  "owner_id",
+  "title",
+  "folderId",
+  "rootFolderId",
+  "recordType"
+]);
+function lintReservedFilterableFieldIds(value, ctx) {
+  const bp = value;
+  bp.schemas?.forEach((schema, si) => {
+    const surfaces = schema.allowedSurfaces ?? ["record"];
+    schema.fields?.forEach((field, fi) => {
+      if (!field?.filterable || !field.fieldId) return;
+      const collidesWith = /* @__PURE__ */ new Set();
+      if (surfaces.includes("record") && RECORD_RESERVED_FILTERABLE_FIELD_IDS.has(field.fieldId)) {
+        for (const k of RECORD_RESERVED_FILTERABLE_FIELD_IDS) collidesWith.add(k);
+      }
+      if (surfaces.includes("document") && DOCUMENT_RESERVED_FILTERABLE_FIELD_IDS.has(field.fieldId)) {
+        for (const k of DOCUMENT_RESERVED_FILTERABLE_FIELD_IDS) collidesWith.add(k);
+      }
+      if (collidesWith.size === 0) return;
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["schemas", si, "fields", fi, "filterable"],
+        message: `schema '${schema.typeName ?? si}': field '${field.fieldId}' cannot be declared filterable \u2014 '${field.fieldId}' is a platform-owned search-index metadata key (${[...collidesWith].sort().join(", ")}) for a surface this schema binds to (${surfaces.join(", ")}), and a filterable payload field of the same name would shadow it in the index. Choose a different fieldId, or leave this field non-filterable.`
+      });
+    });
+  });
+}
 function lintDataScopeKeys(value, ctx) {
   const bp = value;
   for (const key of Object.keys(bp.accessProfile?.dataScope ?? {})) {
@@ -11716,6 +12881,11 @@ function lintDataScopeKeys(value, ctx) {
       lintDataScopeKey(key, ["fragments", name, key], ctx);
     }
   }
+  for (const [name, trigger] of Object.entries(bp.triggers ?? {})) {
+    for (const key of Object.keys(trigger.dataScope ?? {})) {
+      lintDataScopeKey(key, ["triggers", name, "dataScope", key], ctx);
+    }
+  }
 }
 function lintExpectedScopeDims(value, ctx) {
   const bp = value;
@@ -11811,6 +12981,150 @@ function lintAccessProfileRoleIds(value, ctx) {
     seen.add(roleId);
   });
 }
+function lintTriggerFields(value, ctx) {
+  const bp = value;
+  for (const [triggerName, entry] of Object.entries(bp.triggers ?? {})) {
+    const declared = entry?.fields;
+    if (!declared?.length) continue;
+    const schema = bp.schemas?.find((sc) => sc.typeName === entry.firingSource?.schemaName);
+    if (!schema) continue;
+    const lookupNames = /* @__PURE__ */ new Set();
+    for (const lf of schema.lookupFields ?? []) {
+      if (typeof lf === "string") {
+        lookupNames.add(lf);
+        continue;
+      }
+      if (lf?.fieldName) lookupNames.add(lf.fieldName);
+      for (const n of lf?.fieldNames ?? []) lookupNames.add(n);
+      if (lf?.sortBy && lf.sortBy !== "createdAt" && lf.sortBy !== "lastUpdated") {
+        lookupNames.add(lf.sortBy);
+      }
+    }
+    const seenFields = /* @__PURE__ */ new Set();
+    declared.forEach((fieldId, i) => {
+      const def = schema.fields?.find((f) => f.fieldId === fieldId);
+      const path4 = ["triggers", triggerName, "fields", i];
+      if (seenFields.has(fieldId)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: path4,
+          message: `triggers['${triggerName}'].fields names '${fieldId}' more than once \u2014 list it once`
+        });
+        return;
+      }
+      seenFields.add(fieldId);
+      if (def?.sensitive === true) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: path4,
+          message: `triggers['${triggerName}'].fields names '${fieldId}', which is marked 'sensitive'. A sensitive field is blind-indexed and masked, and can never be projected into a trigger script \u2014 drop it from 'fields', or make the field non-sensitive`
+        });
+        return;
+      }
+      if (lookupNames.has(fieldId)) return;
+      if (!def) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: path4,
+          message: `triggers['${triggerName}'].fields names '${fieldId}', which schema '${schema.typeName}' neither declares nor uses as a lookup`
+        });
+        return;
+      }
+      if (def.inline !== true && def.filterable !== true) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: path4,
+          message: `triggers['${triggerName}'].fields names '${fieldId}', which schema '${schema.typeName}' does not keep inline. A rule may project only a field that is 'inline: true', 'filterable: true', or used as a lookup field \u2014 mark it 'inline: true' on the schema, or drop it from 'fields'`
+        });
+      }
+    });
+  }
+}
+function lintScripts(value, ctx) {
+  const bp = value;
+  const scripts = bp.scripts;
+  if (!scripts) return;
+  for (const name of Object.keys(scripts)) {
+    if (!SCRIPT_NAME_RE.test(name)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["scripts", name],
+        message: `scripts['${name}'] is not a valid script name \u2014 use 1-64 characters of letters, digits, underscores ('_') and hyphens ('-'). The map key IS the name the platform stores and a trigger's scriptRef.name resolves against.`
+      });
+    }
+  }
+  for (const [triggerName, trigger] of Object.entries(bp.triggers ?? {})) {
+    const ref = trigger?.scriptRef;
+    if (!ref?.name) continue;
+    if (!Object.prototype.hasOwnProperty.call(scripts, ref.name)) continue;
+    if (ref.version !== "latest") {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["triggers", triggerName, "scriptRef", "version"],
+        message: `triggers['${triggerName}'].scriptRef pins version '${ref.version}' of '${ref.name}', which is a script THIS blueprint ships \u2014 use version: 'latest' instead. Version numbers are assigned by the platform, so a pin cannot be known to name the source declared here; and once that source is edited the pin would keep running the superseded version. Pin a version only for a script this blueprint does not ship.`
+      });
+    }
+  }
+}
+function lintTriggers(value, ctx) {
+  const bp = value;
+  const triggers = bp.triggers;
+  if (!triggers) return;
+  const declaredSchemas = new Set((bp.schemas ?? []).map((s) => s.typeName).filter(Boolean));
+  const triggerEnabledSchemas = new Set(
+    (bp.schemas ?? []).filter((s) => s.capabilities?.triggersEnabled === true).map((s) => s.typeName).filter(Boolean)
+  );
+  const declaredRoles = new Set(Object.keys(bp.roles ?? {}));
+  for (const [name, trigger] of Object.entries(triggers)) {
+    const schemaName = trigger.firingSource?.schemaName;
+    if (schemaName && !declaredSchemas.has(schemaName)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["triggers", name, "firingSource", "schemaName"],
+        message: `triggers['${name}'].firingSource.schemaName names '${schemaName}', which is not a schema this blueprint declares in schemas \u2014 ` + (declaredSchemas.size ? `declared schemas: ${[...declaredSchemas].join(", ")}` : "declared schemas: (none)")
+      });
+    } else if (schemaName && !triggerEnabledSchemas.has(schemaName)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["triggers", name, "firingSource", "schemaName"],
+        message: `triggers['${name}'].firingSource.schemaName names '${schemaName}', which does not enable triggers \u2014 records of that schema would never fire it. Set capabilities.triggersEnabled: true on the '${schemaName}' schema.`
+      });
+    }
+    const roleIds = trigger.roleIds;
+    if (!roleIds) continue;
+    const seen = /* @__PURE__ */ new Set();
+    roleIds.forEach((roleId, i) => {
+      const path4 = ["triggers", name, "roleIds", i];
+      if (!declaredRoles.has(roleId)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: path4,
+          message: `triggers['${name}'].roleIds names '${roleId}', which is not a role this blueprint declares in roles \u2014 ` + (declaredRoles.size ? `declared roles: ${[...declaredRoles].join(", ")}` : "declared roles: (none)")
+        });
+      }
+      if (seen.has(roleId)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: path4,
+          message: `triggers['${name}'].roleIds names '${roleId}' more than once \u2014 remove the duplicate`
+        });
+      }
+      seen.add(roleId);
+      for (const clause of bp.roles?.[roleId] ?? []) {
+        for (const [dim, raw] of Object.entries(clause?.dataScope ?? {})) {
+          for (const v of Array.isArray(raw) ? raw : [raw]) {
+            if (typeof v !== "string" || !IDENTITY_DERIVED_TOKEN_RE.test(v)) continue;
+            ctx.addIssue({
+              code: z.ZodIssueCode.custom,
+              path: path4,
+              message: `triggers['${name}'].roleIds names '${roleId}', whose dataScope['${dim}'] uses '${v}'. '\${{ self.* }}' / '\${{ under.self.* }}' / '\${{ member.* }}' resolve against the TRIGGER PRINCIPAL's identity, not yours, so the platform refuses them in a trigger grant \u2014 inline or composed. The role itself is fine for ordinary use; it just cannot be the grant for a trigger. Give the trigger an inline grant using '\${{ input.* }}' or literal values, or compose a role without an identity-derived dataScope.`
+            });
+          }
+        }
+      }
+    });
+  }
+}
 function lintRoleAssumable(value, ctx) {
   const bp = value;
   const declaredRoles = new Set(Object.keys(bp.roles ?? {}));
@@ -11925,7 +13239,21 @@ var BLUEPRINT_FIELD_PHASES = Object.freeze({
   schemas: "in-context",
   accessProfile: "in-context",
   roles: "in-context",
-  seed: "in-context"
+  seed: "in-context",
+  // Pushed on the same in-context token as the schemas/roles above, and — load-bearing — BEFORE
+  // `triggers`, because a trigger's `scriptRef` is validated AT DECLARE TIME: a rule naming a script
+  // with no versions in the context is refused with a 400. This map does not order the loader (a
+  // plain object's key order is not a contract); the loader orders itself, and a test pins it.
+  scripts: "in-context",
+  // A trigger's principal + grant are provisioned exactly like the roles: block is (N service-
+  // principal/AccessProfile pairs instead of one), so it applies in the identical in-context phase,
+  // under the same re-minted context-confined token.
+  triggers: "in-context",
+  // Setting it requires the platform provisioning capability, which only the bootstrap credential
+  // carries — the same reasoning as issuers/namespaces above. It is applied to the app context
+  // itself, which the bootstrap phase already creates, so there is nothing for the in-context pass
+  // to do with it.
+  identityProjectionClaims: "bootstrap"
 });
 var BlueprintSchema = z.object({
   /** Stable blueprint id (the `--blueprint <name>` selector + idempotency key). */
@@ -11988,13 +13316,77 @@ var BlueprintSchema = z.object({
    * `allowedSurfaces: ['entity']` schema, both need the registration to
    * already exist). `org`/`client` need no entry — they exist already.
    */
-  namespaces: z.array(BlueprintNamespaceSchema).optional()
+  namespaces: z.array(BlueprintNamespaceSchema).optional(),
+  /**
+   * Declares which of the golden IdP-asserted claim names captured by this tenant's issuers (see
+   * `issuers[].capturedClaims`) are projected, read-only, onto access profiles in THIS context.
+   * Applied to the app context in the BOOTSTRAP-token phase, alongside the context's own create.
+   *
+   * Capture and projection are deliberately separate opt-ins: capturing a claim stores it against
+   * the user, projecting it exposes it on a profile in this context. Declaring a name here that no
+   * issuer captures is not an error — it simply never fills.
+   *
+   * <p><b>Fills once, then freezes.</b> A profile's projection is written the first time a sign-in
+   * for that principal can supply a value — usually at profile creation, but for an INVITED member
+   * not until they actually accept and sign in, since there is nothing to project before that.
+   * Once filled it never updates again, even if this declaration or the underlying identity data
+   * changes later. So editing this list affects only profiles that have not been filled yet; it is
+   * not a backfill, and re-applying a blueprint does not re-project existing profiles.
+   *
+   * <p><b>Authority.</b> Setting this needs the platform provisioning capability — the same
+   * authority the bootstrap credential already uses to register issuers and declare namespaces.
+   * An ordinary `app-contexts:u` credential may rename its own context but may not opt it into
+   * projecting IdP-golden identity data, so this field is only settable on the bootstrap phase's
+   * own token, never on the per-context wildcard the in-context load runs under.
+   *
+   * <p>Omit to leave the context's existing declaration unchanged; declare an empty list to
+   * disable future projection. Capped at 20 entries, each a non-blank name of at most 64
+   * characters, duplicates rejected — the same bounds `capturedClaims` carries.
+   *
+   * <p><b>Applies only when this blueprint CREATES the app context.</b> The condition is the
+   * context being created, not the apply being the first one: creating the context separately
+   * beforehand means even the first apply does not set it. Re-applying against a context that
+   * already exists does not change it, in either direction. Edit the declaration on an existing context through the platform API instead. (A
+   * tool applying this blueprint could in principle reconcile it, but doing so also overwrites the
+   * context's name and needs a broader scope — see `@vectros-ai/cli`'s own notes.)
+   */
+  identityProjectionClaims: z.array(
+    z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
+      message: `an identityProjectionClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
+    }).refine((name) => name.trim().length > 0, {
+      message: "an identityProjectionClaims entry must be a non-blank claim name"
+    })
+  ).max(MAX_CAPTURED_CLAIMS, {
+    message: `identityProjectionClaims accepts at most ${MAX_CAPTURED_CLAIMS} entries`
+  }).optional().superRefine(assertNoDuplicateClaimNames("identityProjectionClaims")),
+  /**
+   * Optional scripts this blueprint SHIPS: scriptName -> `{ source, declaredInputContract? }`.
+   *
+   * Distinct from a trigger's `scriptRef`, which only NAMES a script and requires it to already
+   * exist. Pushed BEFORE the `triggers` block, because a `scriptRef` is validated at declare time.
+   *
+   * Each entry is the CURRENT SOURCE for that name, not a version — the platform assigns versions
+   * itself and they are immutable. Re-applying an unchanged blueprint pushes nothing; editing
+   * `source` pushes a new version, which every `version: 'latest'` rule then picks up.
+   */
+  scripts: BlueprintScriptsSchema.optional(),
+  /**
+   * Optional async trigger rules: triggerName -> declaration.
+   *
+   * These FIRE. A record write on a schema that opts in via `capabilities.triggersEnabled`
+   * dispatches the rule's script, which runs asynchronously in a sandbox under the grant declared
+   * here — so a trigger's `allowedActions`/`dataScope`/`capabilities` (or the roles its `roleIds`
+   * composes) are live authority, not a declaration awaiting a future release. Author the grant as
+   * narrowly as you would any other credential's.
+   */
+  triggers: BlueprintTriggersSchema.optional()
 }).strict().superRefine((bp, ctx) => {
   lintSelfTokenPlacement(bp, ctx);
   lintIdentityRefs(bp, ctx);
   lintIdentityOverrides(bp, ctx);
   lintNamespacedScopeArrays(bp, ctx);
   lintDataScopeKeys(bp, ctx);
+  lintReservedFilterableFieldIds(bp, ctx);
   lintExpectedScopeDims(bp, ctx);
   lintDataScopeRefs(bp, ctx);
   lintRoleAssumable(bp, ctx);
@@ -12003,6 +13395,9 @@ var BlueprintSchema = z.object({
   lintIdentitySurfaces(bp, ctx);
   lintIssuerContext(bp, ctx);
   lintNamespaces(bp, ctx);
+  lintTriggers(bp, ctx);
+  lintTriggerFields(bp, ctx);
+  lintScripts(bp, ctx);
 });
 function formatIssuePath(path4) {
   let out = "";
@@ -14087,6 +15482,13 @@ function renderActionableError(info) {
     return `  \u2716 ${msg}
     Your credential lacks the scope for this operation (owner-gated, or a
     narrower context/action than required).
+`;
+  }
+  if (info.statusCode === 409 && /no scoped key can be minted|is not active|is suspended/i.test(msg)) {
+    return `  \u2716 ${msg}
+    This is NOT a scope problem: no credential, including a root key, can mint against an
+    inactive profile or a suspended user, so re-issuing a broader credential will not help.
+    Follow the reactivation step named above, then retry.
 `;
   }
   if (info.statusCode === 404) {
@@ -14253,7 +15655,10 @@ async function mintBridgeToken(opts) {
   let url = `${base}${path4}?ttl=${encodeURIComponent(String(ttlSeconds))}&tenant=${encodeURIComponent(tenant)}`;
   if (contextId) url += `&context=${encodeURIComponent(contextId)}`;
   return fetchStToken(url, cognitoToken, fetchImpl, path4, (status) => {
-    if (status !== 404 || useScopedToken || contextId) return "";
+    if (status !== 404) return "";
+    if (useScopedToken || contextId) {
+      return " (this route answers every refusal with the same 404: the named context may not exist yet, or your own member account may be suspended in it)";
+    }
     return ` (the dedicated ${CLI_BOOTSTRAP_TOKEN_PATH} endpoint may not be deployed yet \u2014 retry with --use-scoped-token for the fallback path)`;
   });
 }
@@ -14268,7 +15673,10 @@ async function mintContextToken(opts) {
   } = opts;
   const base = apiBaseUrl.replace(/\/$/, "");
   const url = `${base}${SCOPED_TOKEN_PATH}?ttl=${encodeURIComponent(String(ttlSeconds))}&tenant=${encodeURIComponent(tenant)}&context=${encodeURIComponent(contextId)}`;
-  return fetchStToken(url, cognitoToken, fetchImpl, `${SCOPED_TOKEN_PATH}?context=${contextId}`);
+  return fetchStToken(url, cognitoToken, fetchImpl, `${SCOPED_TOKEN_PATH}?context=${contextId}`, (status) => {
+    if (status !== 404) return "";
+    return " (this route answers every refusal with the same 404: the named context may not exist, or your own member account may be suspended in it)";
+  });
 }
 
 // src/identity.ts
@@ -14655,7 +16063,21 @@ var KNOWN_CONTROL_PLANE_RESOURCES = [
   // unconditionally, never tenant-wide, so the reach is bounded to what the
   // blueprint already provisions, never the pack's say-so alone. See
   // `@vectros-ai/blueprints`' `namespaces[]` doc for the full design.
-  "namespaces"
+  "namespaces",
+  // The 0.43.0 script/trigger surfaces. Listed for MESSAGE QUALITY only — both were already
+  // rejected by the data-plane allowlist above, but as "unrecognized resource", whose text invites
+  // the reader to widen the allowlist ("if 'scripts' is a new data-plane resource…"). They are not:
+  // the platform deliberately put them out of reach of an ordinary confined partner role (a bare,
+  // non-empty `data_scope` clause — the routine blueprint-issued shape — does not reach scripts at
+  // all), because script authoring is a design-time, admin-shaped surface. So the accurate message
+  // is the control-plane one.
+  //
+  // NOTE on the `x` action letter: `scripts:x` (execute) is a real platform verb, and VALID_OPS
+  // deliberately does NOT gain it. Op letters are only checked AFTER a resource is admitted, and
+  // no admitted resource has an `x` verb — adding it would instead make `records:x` pass the op
+  // check and be admitted as data-plane.
+  "scripts",
+  "triggers"
 ];
 var PARTIALLY_ADMITTED_OPS = /* @__PURE__ */ new Map([
   ["profiles", /* @__PURE__ */ new Set(["r", "u", "d"])]
@@ -14663,6 +16085,13 @@ var PARTIALLY_ADMITTED_OPS = /* @__PURE__ */ new Map([
 var SELF_QUALIFIED_OPS = /* @__PURE__ */ new Map([
   ["profiles", /* @__PURE__ */ new Set(["c"])]
 ]);
+var NAME_QUALIFIED_OPS = /* @__PURE__ */ new Map([
+  ["scripts", /* @__PURE__ */ new Set(["x"])]
+]);
+var RESOURCE_EXTRA_OPS = /* @__PURE__ */ new Map([
+  ["scripts", /* @__PURE__ */ new Set(["x"])]
+]);
+var PLATFORM_SCRIPT_NAME = /^[A-Za-z0-9_-]{1,64}$/;
 var UNQUALIFIABLE_WITH_ANY_TAIL = /* @__PURE__ */ new Map([
   ["profiles", /* @__PURE__ */ new Set(["r"])]
 ]);
@@ -14673,10 +16102,13 @@ var VALID_OPS = /* @__PURE__ */ new Set(["c", "r", "u", "d"]);
 var DATA_PLANE_SET = new Set(DATA_PLANE_ALLOWLIST);
 var CONTROL_PLANE_SET = new Set(KNOWN_CONTROL_PLANE_RESOURCES);
 var ALLOWLIST_HINT = DATA_PLANE_ALLOWLIST.join("/");
+function formatRejection(r) {
+  return r.source ? `${r.action} (${r.source}): ${r.reason}` : `${r.action}: ${r.reason}`;
+}
 var ScopeGateError = class extends Error {
   rejected;
   constructor(rejected) {
-    const summary = rejected.map((r) => `  \u2022 ${r.action}: ${r.reason}`).join("\n");
+    const summary = rejected.map((r) => `  \u2022 ${formatRejection(r)}`).join("\n");
     super(
       `Scope gate rejected ${rejected.length} requested scope(s); the bootstrap loader provisions data-plane access only (${ALLOWLIST_HINT}) and mints nothing on reject:
 ${summary}`
@@ -14691,7 +16123,7 @@ var CAPABILITIES_HINT = GRANTED_CAPABILITIES_ALLOWLIST.join("/");
 var CapabilityGateError = class extends Error {
   rejected;
   constructor(rejected) {
-    const summary = rejected.map((r) => `  \u2022 ${r.action}: ${r.reason}`).join("\n");
+    const summary = rejected.map((r) => `  \u2022 ${formatRejection(r)}`).join("\n");
     super(
       `Capability gate rejected ${rejected.length} requested capability(ies); the bootstrap loader grants (${CAPABILITIES_HINT}) only and mints nothing on reject:
 ${summary}`
@@ -14732,9 +16164,10 @@ function assertCapabilityGate(capabilities) {
     throw new CapabilityGateError(result.rejected);
   }
 }
-function firstInvalidOp(ops) {
+function firstInvalidOp(ops, resource) {
+  const extra = resource === void 0 ? void 0 : RESOURCE_EXTRA_OPS.get(resource);
   for (const ch of ops) {
-    if (!VALID_OPS.has(ch)) return ch;
+    if (!VALID_OPS.has(ch) && !extra?.has(ch)) return ch;
   }
   return void 0;
 }
@@ -14761,19 +16194,24 @@ function evaluateScopeToken(action, capabilities) {
   if (!DATA_PLANE_SET.has(resource)) {
     const admittedOps = PARTIALLY_ADMITTED_OPS.get(resource);
     const selfOnlyOps = SELF_QUALIFIED_OPS.get(resource);
-    if (admittedOps || selfOnlyOps) {
-      const admittedHint = [.../* @__PURE__ */ new Set([...admittedOps ?? [], ...selfOnlyOps ?? []])].sort().join("/");
+    const nameOnlyOps = NAME_QUALIFIED_OPS.get(resource);
+    if (admittedOps || selfOnlyOps || nameOnlyOps) {
+      const admittedHint = [
+        .../* @__PURE__ */ new Set([...admittedOps ?? [], ...selfOnlyOps ?? [], ...nameOnlyOps ?? []])
+      ].sort().join("/");
       if (ops === "*") {
         return {
           action,
           reason: `requests '${resource}:*', which includes operation(s) outside the narrow allowlist (${admittedHint}) admitted for this control-plane resource. Request only the specific operations you need`
         };
       }
-      const invalidOp2 = firstInvalidOp(ops);
+      const invalidOp2 = firstInvalidOp(ops, resource);
       if (invalidOp2) {
+        const extraOps = [...RESOURCE_EXTRA_OPS.get(resource) ?? []].sort();
+        const validHint = ["c", "r", "u", "d", ...extraOps].join(", ");
         return {
           action,
-          reason: `invalid operation character '${invalidOp2}' (valid operations are c, r, u, d, or '*')`
+          reason: `invalid operation character '${invalidOp2}' (valid operations are ${validHint}, or '*')`
         };
       }
       const qualifier = parts.length > 2 ? parts.slice(2).join(":") : void 0;
@@ -14783,10 +16221,29 @@ function evaluateScopeToken(action, capabilities) {
         if (qualifier !== void 0 && unqualifiableOps?.has(ch)) {
           return {
             action,
-            reason: `requests '${resource}:${ch}' alongside a qualifier ('${qualifier}'), but the platform does not resolve a qualifier for '${ch}' on '${resource}' at all \u2014 it will reject the WHOLE entry as malformed, not just ignore the qualifier. Split into separate entries (e.g. '${resource}:${ch}' + the other op(s) with their qualifier).`
+            reason: `requests '${resource}:${ch}' alongside a qualifier ('${qualifier}'), but the platform does not resolve a qualifier for '${ch}' on '${resource}' at all \u2014 it will reject the WHOLE entry as malformed, not just ignore the qualifier. Split into separate entries (e.g. '${resource}:${ch}' + the other op(s) with their qualifier).`
+          };
+        }
+        if (admittedOps?.has(ch)) continue;
+        if (nameOnlyOps?.has(ch)) {
+          if (qualifier !== void 0 && qualifier.includes("*")) {
+            return {
+              action,
+              reason: `requests '${resource}:${ch}:${qualifier}'. Execute grants have NO wildcard \u2014 the qualifier is compared to the script name exactly, so a '*' matches no script and the grant is stored and then refuses every execution, with no error that can say why. Name each script you ship, one entry each: '${resource}:${ch}:<script-name>'`
+            };
+          }
+          if (qualifier !== void 0 && PLATFORM_SCRIPT_NAME.test(qualifier)) continue;
+          if (qualifier !== void 0 && qualifier.length > 0) {
+            return {
+              action,
+              reason: `requests '${resource}:${ch}:${qualifier}', but '${qualifier}' cannot be a script name \u2014 names are 1-64 characters of letters, digits, '_' or '-'. A qualifier that cannot name a script is stored and then matches nothing, so it is refused here rather than at an execution that cannot explain itself`
+            };
+          }
+          return {
+            action,
+            reason: `requests a bare '${resource}:${ch}' with no qualifier. Execution gates on the action verb and the script NAME, and consults no data scope \u2014 so a bare grant means 'may run every script in this context', including ones added later that this blueprint's reviewer never saw. Name each script you ship, one entry each \u2014 '${resource}:${ch}:<script-name>' \u2014 there is no wildcard form.`
           };
         }
-        if (admittedOps?.has(ch)) continue;
         if (selfOnlyOps?.has(ch)) {
           if (isSelfQualified) continue;
           const unlockCapability = CAPABILITY_UNLOCKED_OPS.get(resource)?.get(ch);
@@ -14857,6 +16314,50 @@ function assertBlueprintGates(blueprint) {
       assertCapabilityGate(clause.capabilities);
     }
   }
+  for (const [triggerName, entry] of Object.entries(blueprint.triggers ?? {})) {
+    if (entry.allowedActions === void 0) continue;
+    try {
+      assertScopeGate(entry.allowedActions, entry.capabilities);
+      assertCapabilityGate(entry.capabilities);
+    } catch (err) {
+      throw withTriggerContext(err, triggerName);
+    }
+  }
+  assertScriptGrantsNameADeclaredScript(blueprint);
+}
+function assertScriptGrantsNameADeclaredScript(blueprint) {
+  const declared = Object.keys(blueprint.scripts ?? {});
+  if (declared.length === 0) return;
+  const rejected = [];
+  const check = (actions, source) => {
+    for (const action of actions ?? []) {
+      const parts = action.trim().split(":");
+      if (parts[0] !== "scripts" || parts[1] !== "x") continue;
+      const name = parts.length > 2 ? parts.slice(2).join(":") : void 0;
+      if (name === void 0 || name.length === 0 || name.includes("*")) continue;
+      if (!declared.includes(name)) {
+        rejected.push({
+          action,
+          reason: `grants execute on '${name}', which this blueprint does not ship \u2014 it declares ${declared.map((d) => `'${d}'`).join(", ")}. Nothing downstream can catch this: the platform stores the grant, and every execution then fails with a 403 that cannot say the name is wrong. Fix the spelling, or drop the grant if the script is provisioned elsewhere`,
+          ...source ? { source } : {}
+        });
+      }
+    }
+  };
+  check(blueprint.accessProfile.allowedActions);
+  for (const [roleId, clauses] of Object.entries(blueprint.roles ?? {})) {
+    for (const clause of clauses) check(clause.allowedActions, `role '${roleId}'`);
+  }
+  for (const [triggerName, entry] of Object.entries(blueprint.triggers ?? {})) {
+    check(entry.allowedActions, `trigger '${triggerName}'`);
+  }
+  if (rejected.length > 0) throw new ScopeGateError(rejected);
+}
+function withTriggerContext(err, triggerName) {
+  if (err instanceof ScopeGateError || err instanceof CapabilityGateError) {
+    for (const r of err.rejected) r.source ??= `trigger '${triggerName}'`;
+  }
+  return err;
 }
 function effectiveAccessProfileActions(blueprint) {
   if (blueprint.accessProfile.allowedActions !== void 0) {
@@ -14968,10 +16469,391 @@ async function resolveApplyTimeIdentities(blueprint, provisioned, bootstrapClien
   const resolved = await resolveBlueprintIdentities(blueprint, resolver);
   return parseBlueprint(resolved);
 }
-
-// src/loader.ts
-function actionOf(created) {
-  return created ? "created" : "reconciled";
+
+// src/scope-grammar.ts
+var FORBIDDEN_SCOPE_NAMESPACES2 = /* @__PURE__ */ new Set([
+  "user",
+  "record",
+  "document",
+  "entity",
+  "self",
+  "tenant",
+  "context",
+  "scope",
+  "versions",
+  "lookup"
+]);
+var SCOPE_NAMESPACE_RE2 = /^[a-z][a-z0-9_-]{1,31}$/;
+var SCOPE_NAMESPACE_MIN_LENGTH = 2;
+var SCOPE_NAMESPACE_MAX_LENGTH = 32;
+var SCOPE_VALUE_RE2 = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var SCOPE_VALUE_MIN_LENGTH = 1;
+var SCOPE_VALUE_MAX_LENGTH = 128;
+function valueGrammarError(value) {
+  if (!SCOPE_VALUE_RE2.test(value)) {
+    return `'${value}' is not a valid scope value \u2014 ${SCOPE_VALUE_MIN_LENGTH}-${SCOPE_VALUE_MAX_LENGTH} characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'. A value may not contain a colon.`;
+  }
+  return null;
+}
+function namespaceGrammarError(ns) {
+  if (FORBIDDEN_SCOPE_NAMESPACES2.has(ns)) {
+    return `'${ns}' is a reserved namespace and cannot be used as an ownership scope`;
+  }
+  if (!SCOPE_NAMESPACE_RE2.test(ns)) {
+    return `'${ns}' is not a valid namespace \u2014 lowercase, ${SCOPE_NAMESPACE_MIN_LENGTH}-${SCOPE_NAMESPACE_MAX_LENGTH} characters, starting with a letter and continuing with letters, digits, '_' or '-'`;
+  }
+  return null;
+}
+function assertScopeEntries(entries, flag) {
+  if (!entries?.length) return;
+  for (const raw of entries) {
+    const sep = raw.indexOf(":");
+    if (sep <= 0 || sep === raw.length - 1) {
+      throw new Error(`${flag} must be '<namespace>:<value>' (e.g. 'org:6ba7...'); got '${raw}'.`);
+    }
+    const nsError = namespaceGrammarError(raw.slice(0, sep));
+    if (nsError) throw new Error(`${flag} namespace ${nsError}`);
+    const valError = valueGrammarError(raw.slice(sep + 1));
+    if (valError) throw new Error(`${flag} value ${valError}`);
+  }
+}
+function assertIdentityOverrideValues(overrides, flag) {
+  if (!overrides) return;
+  for (const [key, value] of Object.entries(overrides)) {
+    if (!key.startsWith("scope:")) continue;
+    const error = valueGrammarError(typeof value === "string" ? value : String(value));
+    if (error) throw new Error(`${flag} '${key}' value ${error}`);
+  }
+}
+function placeholderScopeNamespace(value) {
+  const self2 = /^\$\{\{\s*(?:under\.)?self\.scope\.([^\s}]+)\s*\}\}$/.exec(value);
+  if (self2) return self2[1];
+  const member = MEMBER_SCOPE_PLACEHOLDER_RE2.exec(value);
+  return member ? member[1] : null;
+}
+var SELF_PLACEHOLDER_RE = /^\$\{\{\s*self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
+var UNDER_SELF_PLACEHOLDER_RE2 = /^\$\{\{\s*under\.self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
+var MEMBER_SCOPE_PLACEHOLDER_RE2 = /^\$\{\{\s*member\.scope\.([a-z][a-z0-9_-]{1,31})(?::[a-z][a-z0-9_-]{1,31})?\s*\}\}$/;
+var ROLE_ID_RE2 = /^[a-z][a-z0-9-]{2,30}$/;
+var MAX_ASSIGNABLE_ROLES2 = 20;
+function parseAssignableRoles(raw, flag = "--assignable-role") {
+  if (!raw || raw.length === 0) return void 0;
+  if (raw.length > MAX_ASSIGNABLE_ROLES2) {
+    throw new Error(`${flag} accepts at most ${MAX_ASSIGNABLE_ROLES2} entries; got ${raw.length}.`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const roleId of raw) {
+    if (!ROLE_ID_RE2.test(roleId)) {
+      throw new Error(
+        `${flag} '${roleId}' is not a valid roleId \u2014 3-31 characters, starting with a lowercase letter and continuing with lowercase letters, digits or '-'.`
+      );
+    }
+    if (seen.has(roleId)) {
+      throw new Error(`${flag} repeats '${roleId}' \u2014 list it once.`);
+    }
+    seen.add(roleId);
+  }
+  return [...raw];
+}
+
+// src/verb-support.ts
+async function withAuth(opts, deps, body) {
+  const log = deps.log ?? createLogger2();
+  const resolveAuth = deps.resolveAuth ?? resolveAuthContext;
+  let auth;
+  try {
+    auth = await resolveAuth({
+      env: opts.env,
+      baseUrl: opts.baseUrl,
+      token: opts.token,
+      context: opts.context,
+      provisioning: opts.provisioning,
+      tenant: opts.tenant,
+      useScopedToken: opts.useScopedToken,
+      log
+    });
+  } catch (err) {
+    if (err instanceof MissingCredentialError) {
+      process.stderr.write(`  \u2716 ${err.message}
+`);
+      return 2;
+    }
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 1;
+  }
+  return body(auth, log);
+}
+function requireTenantId(auth) {
+  if (!auth.tenantId) {
+    throw new Error(
+      "Could not resolve tenantId from /v1/ping \u2014 the extended ping (tenant_id) must be deployed."
+    );
+  }
+  return auth.tenantId;
+}
+function normalizePrincipalUserId(principal) {
+  return principal.startsWith("usr_") ? principal.slice("usr_".length) : principal;
+}
+function splitCsv(csv) {
+  return csv.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function parseScopeOverrides(scopes) {
+  if (!scopes || scopes.length === 0) return void 0;
+  const out = {};
+  for (const raw of scopes) {
+    const sep = raw.indexOf(":");
+    if (sep <= 0 || sep === raw.length - 1) {
+      throw new Error(`--scope must be '<namespace>:<value>' (e.g. 'org:6ba7...'); got '${raw}'.`);
+    }
+    const ns = raw.slice(0, sep);
+    const value = raw.slice(sep + 1);
+    const valueError = valueGrammarError(value);
+    if (valueError) throw new Error(`--scope value ${valueError}`);
+    const key = `scope:${ns}`;
+    if (Object.prototype.hasOwnProperty.call(out, key)) {
+      throw new Error(`--scope sets namespace '${ns}' more than once \u2014 a scope override takes at most one value per namespace.`);
+    }
+    out[key] = value;
+  }
+  if (Object.keys(out).length > 2) {
+    throw new Error("--scope allows at most two distinct namespaces.");
+  }
+  return out;
+}
+function parseJsonObjectFlag(flag, raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`${flag} is not valid JSON: ${raw}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${flag} must be a JSON object (e.g. '{"userId":["<id>"]}').`);
+  }
+  return parsed;
+}
+
+// src/paginate.ts
+var PAGE_LIMIT = 100;
+async function drainPages(fetch2) {
+  const out = [];
+  let startFrom;
+  for (; ; ) {
+    const page = await fetch2(startFrom);
+    if (page.data) out.push(...page.data);
+    const next = page.nextCursor;
+    if (!next) break;
+    startFrom = next;
+  }
+  return out;
+}
+
+// src/loader.ts
+function actionOf(created) {
+  return created ? "created" : "reconciled";
+}
+function triggerPrincipalExternalId(blueprintName, triggerName) {
+  return `${blueprintName}-trigger-${triggerName}`;
+}
+var SCRIPT_CONFLICT_RETRY_DELAY_MS = 750;
+function isVersionConflict(err) {
+  return typeof err === "object" && err !== null && err.statusCode === 409;
+}
+async function readLatestScriptVersion(ctxClient, name) {
+  const versions = await drainPages(
+    (startFrom) => ctxClient.scripts.listScripts({ name, startFrom, limit: PAGE_LIMIT })
+  );
+  return versions.reduce((best, row) => {
+    if (row.scriptVersion === void 0) return best;
+    if (best === void 0 || best.scriptVersion === void 0) return row;
+    return row.scriptVersion > best.scriptVersion ? row : best;
+  }, void 0);
+}
+function requireScriptId(row, name) {
+  if (!row.id) {
+    throw new Error(`Script '${name}' listing returned a version with no id.`);
+  }
+  return row.id;
+}
+function scriptMatches(stored, declared) {
+  return stored.source === declared.source && (stored.declaredInputContract ?? void 0) === declared.declaredInputContract;
+}
+async function ensureScripts(args) {
+  const { ctxClient, scripts, log } = args;
+  const actions = [];
+  for (const [name, entry] of Object.entries(scripts)) {
+    let latest = await readLatestScriptVersion(ctxClient, name);
+    if (latest !== void 0 && scriptMatches(latest, entry)) {
+      actions.push({
+        name,
+        action: "unchanged",
+        id: requireScriptId(latest, name),
+        scriptVersion: latest.scriptVersion ?? 0
+      });
+      log.debug(
+        { component: "loader", scriptName: name, scriptVersion: latest.scriptVersion },
+        "script already matches the declared source \u2014 no version pushed"
+      );
+      continue;
+    }
+    const body = { name, source: entry.source, declaredInputContract: entry.declaredInputContract };
+    let pushed;
+    try {
+      pushed = await ctxClient.scripts.createScript(body);
+    } catch (err) {
+      if (!isVersionConflict(err)) throw err;
+      log.debug(
+        { component: "loader", scriptName: name },
+        "concurrent push detected (409) \u2014 pausing, then re-reading the current version"
+      );
+      await new Promise((resolve) => setTimeout(resolve, SCRIPT_CONFLICT_RETRY_DELAY_MS));
+      try {
+        latest = await readLatestScriptVersion(ctxClient, name);
+      } catch (readErr) {
+        throw new Error(
+          `Script '${name}': a concurrent push was detected (409) and the follow-up read to resolve it also failed (${readErr instanceof Error ? readErr.message : String(readErr)}). Re-run the apply once the other write has settled.`
+        );
+      }
+      if (latest !== void 0 && scriptMatches(latest, entry)) {
+        actions.push({
+          name,
+          action: "unchanged",
+          id: requireScriptId(latest, name),
+          scriptVersion: latest.scriptVersion ?? 0
+        });
+        log.debug(
+          { component: "loader", scriptName: name, scriptVersion: latest.scriptVersion },
+          "the concurrent push stored the same source \u2014 converged, nothing to do"
+        );
+        continue;
+      }
+      try {
+        pushed = await ctxClient.scripts.createScript(body);
+      } catch (retryErr) {
+        if (!isVersionConflict(retryErr)) throw retryErr;
+        throw new Error(
+          `Script '${name}': still conflicting (409) after a re-read and retry. Another apply is pushing this script name concurrently \u2014 re-run once it has finished.`
+        );
+      }
+    }
+    if (!pushed.id) {
+      throw new Error(`Script '${name}' push returned no id.`);
+    }
+    const firstVersion = latest === void 0;
+    actions.push({
+      name,
+      action: firstVersion ? "created" : "superseded",
+      id: pushed.id,
+      scriptVersion: pushed.scriptVersion ?? 0
+    });
+    log.debug(
+      { component: "loader", scriptName: name, scriptVersion: pushed.scriptVersion },
+      firstVersion ? "script pushed \u2014 first version for this name in this context" : "script source changed \u2014 new version pushed over an existing name"
+    );
+  }
+  return actions;
+}
+async function pruneUndeclaredTriggers(args) {
+  const { ctxClient, blueprintName, contextId, declaredNames, log } = args;
+  const pruned = [];
+  const skipped = [];
+  let live;
+  try {
+    live = await drainPages(
+      (startFrom) => ctxClient.triggers.listTriggers({ startFrom, limit: PAGE_LIMIT })
+    );
+  } catch (err) {
+    log.warn(
+      { component: "loader", err: extractServerError(err) },
+      "could not list trigger rules \u2014 skipping the trigger reconcile entirely; a trigger removed from this blueprint may still be live"
+    );
+    return { pruned, skipped: [{ reason: "the context's trigger rules could not be listed" }] };
+  }
+  for (const row of live) {
+    if (!row.name || !row.id || !row.principalId) {
+      if (!declaredNames.has(row.name ?? "")) {
+        skipped.push({
+          name: row.name,
+          reason: "the trigger rule carries no id/name/principal, so it cannot be safely de-provisioned"
+        });
+      }
+      continue;
+    }
+    if (declaredNames.has(row.name)) continue;
+    if (!row.provisionedBy) {
+      skipped.push({
+        name: row.name,
+        reason: "it carries no blueprint provenance marker, so it cannot be attributed to this blueprint"
+      });
+      continue;
+    }
+    if (row.provisionedBy !== blueprintName) {
+      log.debug(
+        { component: "loader", triggerName: row.name, provisionedBy: row.provisionedBy },
+        "undeclared trigger left untouched \u2014 provisioned by a different blueprint"
+      );
+      continue;
+    }
+    let principalExternalId;
+    try {
+      principalExternalId = (await ctxClient.identity.getUser({ id: normalizePrincipalUserId(row.principalId) })).externalId;
+    } catch (err) {
+      log.warn(
+        { component: "loader", triggerName: row.name, principalId: row.principalId, err: extractServerError(err) },
+        "could not resolve a trigger's principal \u2014 leaving the trigger in place"
+      );
+      skipped.push({
+        name: row.name,
+        reason: "its service principal could not be read, so ownership could not be fully established"
+      });
+      continue;
+    }
+    if (principalExternalId !== triggerPrincipalExternalId(blueprintName, row.name)) {
+      log.warn(
+        { component: "loader", triggerName: row.name, principalId: row.principalId },
+        "undeclared trigger left untouched \u2014 it carries this blueprint's provenance marker but names a principal this blueprint did not mint for it"
+      );
+      skipped.push({
+        name: row.name,
+        reason: "it names a service principal this blueprint did not mint for a trigger of that name, so its provenance is inconsistent"
+      });
+      continue;
+    }
+    let profileDeleted = true;
+    try {
+      await ctxClient.auth.deleteAccessProfile({ contextId, principalId: row.principalId });
+    } catch (err) {
+      if (!isNotFound(err)) {
+        log.warn(
+          { component: "loader", triggerName: row.name, principalId: row.principalId, err: extractServerError(err) },
+          "could not delete a removed trigger's access profile \u2014 leaving the trigger rule in place so the next apply retries"
+        );
+        skipped.push({ name: row.name, reason: "its access profile could not be deleted, so its grant may still be live" });
+        continue;
+      }
+      profileDeleted = false;
+    }
+    try {
+      await ctxClient.triggers.deleteTrigger({ id: row.id });
+    } catch (err) {
+      log.warn(
+        { component: "loader", triggerName: row.name, err: extractServerError(err) },
+        "a removed trigger's access profile was deleted but the rule itself was not \u2014 it can no longer execute, and the next apply will retry the rule"
+      );
+      skipped.push({ name: row.name, reason: "its grant was removed but the rule row itself could not be deleted" });
+      continue;
+    }
+    pruned.push({ name: row.name, principalId: row.principalId, profileDeleted });
+    log.debug(
+      { component: "loader", triggerName: row.name, principalId: row.principalId, profileDeleted },
+      "undeclared trigger de-provisioned (no longer declared by this blueprint)"
+    );
+  }
+  return { pruned, skipped };
+}
+function isNotFound(err) {
+  return typeof err === "object" && err !== null && err.statusCode === 404;
 }
 async function registerNamespaceIdempotently(client, blueprintContextId, decl) {
   const contextIdForRequest = decl.tenantWide ? void 0 : blueprintContextId;
@@ -15075,6 +16957,10 @@ function toSdkFields(blueprint, schemaIndex) {
     required: f.required,
     searchable: f.searchable,
     filterable: f.filterable,
+    // Forwarded explicitly, like every sibling here: this mapping is a named-property list, not a
+    // spread, so an unforwarded field is dropped SILENTLY rather than failing — which is what
+    // happened to `validation` before it was added below.
+    inline: f.inline,
     description: f.description,
     enumValues: mapEnumValues(f.enumValues),
     // Format passthrough — the loader previously DROPPED this (the
@@ -15130,13 +17016,16 @@ function toCapabilities(capabilities) {
   if (!capabilities) return void 0;
   const out = {};
   if (capabilities.auditHistory !== void 0) out.auditHistory = capabilities.auditHistory;
+  if (capabilities.triggersEnabled !== void 0)
+    out.triggersEnabled = capabilities.triggersEnabled;
   return Object.keys(out).length > 0 ? out : void 0;
 }
 function toRoleScopeClauses(clauses) {
   return clauses.map((c) => ({
     allowed_actions: c.allowedActions,
     data_scope: c.dataScope,
-    granted_capabilities: c.capabilities
+    granted_capabilities: c.capabilities,
+    assignable_roles: c.assignableRoles
   }));
 }
 var UnresolvedIdentitiesError = class extends Error {
@@ -15173,7 +17062,13 @@ async function provisionContext(client, input) {
   const { blueprint, allowTenantWideNamespaces = false, readExistingKey, confirmExistingPrincipal, log } = input;
   assertBlueprintGates(blueprint);
   assertTenantWideNamespacesAllowed(blueprint, allowTenantWideNamespaces);
-  const ctxResp = await client.auth.createAppContext({ body: { contextId: blueprint.contextId, name: contextNameOf(blueprint) } });
+  const ctxResp = await client.auth.createAppContext({
+    body: {
+      contextId: blueprint.contextId,
+      name: contextNameOf(blueprint),
+      ...blueprint.identityProjectionClaims === void 0 ? {} : { identityProjectionClaims: blueprint.identityProjectionClaims }
+    }
+  });
   const contextAction = actionOf(ctxResp.created);
   log.debug({ component: "loader", contextId: blueprint.contextId, contextAction }, "app-context ensured");
   const user = await client.identity.createUser({
@@ -15260,7 +17155,8 @@ async function runLoader(client, input) {
       subClaim: issuer.subClaim,
       emailClaim: issuer.emailClaim,
       userinfoUri: issuer.userinfoUri,
-      selfSignupPolicies
+      selfSignupPolicies,
+      capturedClaims: issuer.capturedClaims
     });
     const action = actionOf(issuerResp.created);
     issuerActions.push({ issuerId: issuer.issuerId, action });
@@ -15276,7 +17172,8 @@ async function runLoader(client, input) {
         subClaim: issuer.subClaim,
         emailClaim: issuer.emailClaim,
         userinfoUri: issuer.userinfoUri,
-        selfSignupPolicies
+        selfSignupPolicies,
+        capturedClaims: issuer.capturedClaims
       });
       log.debug({ component: "loader", issuerId: issuer.issuerId }, "issuer already registered \u2014 reconciled safe fields to the declared values");
     } else {
@@ -15357,7 +17254,10 @@ async function runLoader(client, input) {
         data_scope: blueprint.accessProfile.dataScope,
         // Already gate-validated (assertBlueprintGates, above this function's
         // call site) before this body is ever built.
-        granted_capabilities: blueprint.accessProfile.capabilities
+        granted_capabilities: blueprint.accessProfile.capabilities,
+        // Absent means "no roleId restriction" server-side; an empty list is refused. Undeclared
+        // must therefore stay `undefined` rather than becoming `[]`.
+        assignable_roles: blueprint.accessProfile.assignableRoles
       }
     ],
     // Optional identity overrides — scope values the service key STAMPS onto
@@ -15380,6 +17280,109 @@ async function runLoader(client, input) {
     body: profileBody
   });
   log.debug({ component: "loader", principalId: `usr_${userId}`, accessProfileId: profile.id, profileAction }, "access profile ensured + reconciled to declared scopes");
+  const scriptActions = blueprint.scripts ? await ensureScripts({ ctxClient, scripts: blueprint.scripts, log }) : [];
+  const triggerActions = [];
+  for (const [triggerName, entry] of Object.entries(blueprint.triggers ?? {})) {
+    const schemaId = schemaIds[entry.firingSource.schemaName];
+    if (!schemaId) {
+      throw new Error(
+        `Trigger '${triggerName}' names schema '${entry.firingSource.schemaName}', which has no resolved schemaId \u2014 the schema failed to provision.`
+      );
+    }
+    const triggerUser = await client.identity.createUser({
+      body: {
+        externalId: triggerPrincipalExternalId(blueprint.name, triggerName),
+        type: "SERVICE",
+        payload: { displayName: `Trigger: ${triggerName}` }
+      }
+    });
+    const triggerUserId = triggerUser.id;
+    if (!triggerUserId) {
+      throw new Error(`Trigger '${triggerName}' service-principal create returned no user id.`);
+    }
+    const triggerPlaceholderProfileBody = {
+      principalId: `usr_${triggerUserId}`,
+      scopes: [{ allowed_actions: ["triggers:r"] }]
+    };
+    const triggerProfile = await ctxClient.auth.createAccessProfile({
+      contextId: blueprint.contextId,
+      body: triggerPlaceholderProfileBody
+    });
+    log.debug(
+      { component: "loader", triggerName, principalId: `usr_${triggerUserId}`, accessProfileId: triggerProfile.id },
+      "trigger principal + placeholder access profile ensured (no declared grant attached yet)"
+    );
+    const triggerResp = await ctxClient.triggers.createTrigger({
+      upsert: true,
+      body: {
+        name: triggerName,
+        firingSource: { schemaId, event: entry.firingSource.event },
+        scriptRef: entry.scriptRef,
+        roleIds: entry.roleIds,
+        scopes: entry.roleIds ? void 0 : [
+          {
+            allowed_actions: entry.allowedActions,
+            data_scope: entry.dataScope,
+            granted_capabilities: entry.capabilities
+          }
+        ],
+        manifest: entry.manifest,
+        // REQUIRED on create. `[]` is a real declaration ("project nothing beyond input.recordId"),
+        // not an omission, so it is forwarded as-is rather than collapsed to undefined the way an
+        // absent optional would be — the blueprint schema makes it required precisely so an author
+        // STATES it.
+        fields: entry.fields,
+        principalId: `usr_${triggerUserId}`,
+        // The PROVENANCE MARKER the reconcile-by-absence pass gates its deletes on. Stamped on every
+        // apply (not only the first) so a trigger provisioned before this field existed acquires one
+        // the next time its blueprint is applied — the platform accepts a set-when-absent and refuses
+        // a CHANGE, so re-stating it is idempotent and can never re-point someone else's trigger.
+        provisionedBy: blueprint.name
+      }
+    });
+    triggerActions.push({ name: triggerName, action: actionOf(triggerResp.created) });
+    log.debug({ component: "loader", triggerName, action: actionOf(triggerResp.created) }, "trigger rule ensured (upsert)");
+    const triggerProfileBody = entry.roleIds ? { principalId: `usr_${triggerUserId}`, roleIds: entry.roleIds } : {
+      principalId: `usr_${triggerUserId}`,
+      scopes: [
+        {
+          // Non-null: the `else` branch of the roleIds XOR above — BlueprintTriggerEntrySchema
+          // guarantees allowedActions is set whenever roleIds is not.
+          allowed_actions: entry.allowedActions,
+          data_scope: entry.dataScope,
+          granted_capabilities: entry.capabilities
+        }
+      ]
+    };
+    await ctxClient.auth.updateAccessProfile({
+      contextId: blueprint.contextId,
+      principalId: `usr_${triggerUserId}`,
+      body: triggerProfileBody
+    });
+    log.debug(
+      { component: "loader", triggerName, principalId: `usr_${triggerUserId}` },
+      "trigger access profile widened to its declared grant"
+    );
+  }
+  let triggerPrunes = [];
+  let triggerPruneSkipped = [];
+  if (input.pruneTriggers === false) {
+    log.debug({ component: "loader" }, "trigger reconcile-by-absence skipped \u2014 disabled by the caller");
+  } else if (!input.remintForContext) {
+    log.warn(
+      { component: "loader", contextId: blueprint.contextId },
+      "trigger reconcile-by-absence skipped \u2014 no per-context client is wired, so a removed trigger may still be live"
+    );
+    triggerPruneSkipped = [{ reason: "no per-context client was wired, so triggers could not be reconciled in the blueprint's own context" }];
+  } else {
+    ({ pruned: triggerPrunes, skipped: triggerPruneSkipped } = await pruneUndeclaredTriggers({
+      ctxClient,
+      blueprintName: blueprint.name,
+      contextId: blueprint.contextId,
+      declaredNames: new Set(Object.keys(blueprint.triggers ?? {})),
+      log
+    }));
+  }
   const keyName = keyNameFor(blueprint.name, machineId);
   let keyAction = "created";
   let revokedKeyId;
@@ -15501,6 +17504,10 @@ async function runLoader(client, input) {
     profileAction,
     schemaActions,
     roleActions,
+    scriptActions,
+    triggerActions,
+    triggerPrunes,
+    triggerPruneSkipped,
     issuerActions,
     namespaceActions,
     rawKey,
@@ -15521,7 +17528,11 @@ function renderPlanDataScope(ds) {
 }
 function buildPlan(blueprint, opts = {}) {
   const steps = [];
-  steps.push({ kind: "context", summary: `context '${blueprint.contextId}' (${contextNameOf(blueprint)})` });
+  const projection = blueprint.identityProjectionClaims?.length ? `, identity projection: [${blueprint.identityProjectionClaims.join(", ")}]` : blueprint.identityProjectionClaims ? ", identity projection: disabled (empty list)" : "";
+  steps.push({
+    kind: "context",
+    summary: `context '${blueprint.contextId}' (${contextNameOf(blueprint)}${projection})`
+  });
   steps.push({
     kind: "principal",
     summary: `principal '${blueprint.servicePrincipal.externalId}' (SERVICE)`
@@ -15537,9 +17548,10 @@ function buildPlan(blueprint, opts = {}) {
   }
   for (const iss of blueprint.issuers ?? []) {
     const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: ${iss.selfSignupPolicies.length} polic${iss.selfSignupPolicies.length === 1 ? "y" : "ies"}` : "";
+    const captured = iss.capturedClaims?.length ? `, captured claims: [${iss.capturedClaims.join(", ")}]` : "";
     steps.push({
       kind: "issuer",
-      summary: `issuer '${iss.issuerId}' (${iss.issuer} \u2192 context '${iss.contextId}'${selfSignup}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
+      summary: `issuer '${iss.issuerId}' (${iss.issuer} \u2192 context '${iss.contextId}'${selfSignup}${captured}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
     });
   }
   for (const s of blueprint.schemas) {
@@ -15561,7 +17573,8 @@ function buildPlan(blueprint, opts = {}) {
     const roleCapabilityNote = capSet.length ? `, capabilities [${capSet.join(", ")}]` : "";
     const clauseLines = clauses.map((c, i) => {
       const capNote = c.capabilities?.length ? `, capabilities [${c.capabilities.join(", ")}]` : "";
-      return `      clause ${i + 1}: actions [${c.allowedActions.join(", ")}], dataScope: ${renderPlanDataScope(c.dataScope)}${capNote}`;
+      const assignableNote = c.assignableRoles?.length ? `, assignableRoles [${c.assignableRoles.join(", ")}]` : "";
+      return `      clause ${i + 1}: actions [${c.allowedActions.join(", ")}], dataScope: ${renderPlanDataScope(c.dataScope)}${capNote}${assignableNote}`;
     });
     const assumable = blueprint.roleAssumable?.[roleId];
     const assumableLine = assumable ? `
@@ -15591,6 +17604,43 @@ function buildPlan(blueprint, opts = {}) {
       summary: `profile scopes [${actions.join(", ")}]${planeNote}${scopeNote}${capabilityNote}`
     });
   }
+  for (const [scriptName, entry] of Object.entries(blueprint.scripts ?? {})) {
+    const bytes = new TextEncoder().encode(entry.source).length;
+    const contractNote = entry.declaredInputContract ? " + input contract" : "";
+    steps.push({
+      kind: "script",
+      summary: `script '${scriptName}' (ensure latest matches ${bytes} bytes of source${contractNote}) [${BLUEPRINT_FIELD_PHASES.scripts}-token phase]`
+    });
+  }
+  for (const [triggerName, entry] of Object.entries(blueprint.triggers ?? {})) {
+    steps.push({
+      kind: "principal",
+      summary: `trigger '${triggerName}' principal '${blueprint.name}-trigger-${triggerName}' (SERVICE)`
+    });
+    steps.push({
+      kind: "profile",
+      summary: `trigger '${triggerName}' profile: minimal placeholder grant (minted before the trigger row exists)`
+    });
+    const manifestNote = entry.manifest?.length ? ` manifest: [${entry.manifest.join(", ")}]` : " manifest: (none \u2014 full grant applies)";
+    const fieldsNote = entry.fields?.length ? ` projects: [${entry.fields.join(", ")}]` : " projects: (nothing beyond the record id)";
+    steps.push({
+      kind: "trigger",
+      summary: `trigger '${triggerName}': ${entry.firingSource.schemaName}.${entry.firingSource.event} \u2192 ${entry.scriptRef.name}@${entry.scriptRef.version}${fieldsNote}${manifestNote} [${BLUEPRINT_FIELD_PHASES.triggers}-token phase]`
+    });
+    if (entry.roleIds) {
+      steps.push({
+        kind: "profile",
+        summary: `trigger '${triggerName}' profile widened via role(s) [${entry.roleIds.join(", ")}] (composed)`
+      });
+    } else {
+      const scopeNote = entry.dataScope && Object.keys(entry.dataScope).length ? ` dataScope: ${Object.keys(entry.dataScope).join(", ")}` : "";
+      const capabilityNote = entry.capabilities?.length ? ` capabilities: [${entry.capabilities.join(", ")}]` : "";
+      steps.push({
+        kind: "profile",
+        summary: `trigger '${triggerName}' profile widened to declared scopes [${(entry.allowedActions ?? []).join(", ")}]${scopeNote}${capabilityNote}`
+      });
+    }
+  }
   steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
   const seeds = blueprint.seed ?? [];
   if (seeds.length > 0 && !opts.noSeed) {
@@ -15606,9 +17656,27 @@ function buildPlan(blueprint, opts = {}) {
 function renderPlan(blueprint, steps) {
   const header = `  Plan for blueprint '${blueprint.name}' (v${blueprint.version}) \u2192 context '${blueprint.contextId}':`;
   const legendLines = [
-    `  Apply is a non-destructive reconcile \u2014 each item is created if absent, else`,
-    `  updated in place to match. Nothing is dropped or recreated.`
+    `  Apply is a reconcile \u2014 each item is created if absent, else updated in place to`,
+    `  match. Nothing is recreated, and nothing is dropped except as noted below.`
   ];
+  legendLines.push(
+    `  Exception: triggers are also reconciled by ABSENCE \u2014 a trigger this blueprint`,
+    `  previously provisioned and no longer declares is DELETED (the rule and its access`,
+    `  profile; its service principal is kept). This applies even when this plan shows no`,
+    `  trigger steps: removing the last one is exactly what leaves none to show. Triggers`,
+    `  created outside this blueprint are never touched. Each deletion is named in the`,
+    `  apply output.`
+  );
+  legendLines.push(
+    `  Counter-exception: a script is never updated in place \u2014 a changed source ADDS a new`,
+    `  immutable version and every earlier one persists, which is also how a 'latest' rule`,
+    `  picks the change up. And scripts are NOT reconciled by absence: a script this blueprint`,
+    `  previously shipped and no longer declares is LEFT IN PLACE, including every stored`,
+    `  version. A script row carries no provisioning marker, so an apply cannot tell one it`,
+    `  created from one you pushed by hand \u2014 and a wrong delete is unrecoverable and would`,
+    `  break any trigger still referencing it. Remove one deliberately with`,
+    `  'vectros scripts delete', after 'vectros scripts list' shows you what is there.`
+  );
   if (steps.some((s) => s.kind === "issuer")) {
     legendLines.push(
       `  Exception: an issuer's trust-anchor fields (issuer, jwksUri, audience,`,
@@ -17860,6 +19928,19 @@ function namespaceTally(items) {
   if (matched) seg.push(`${matched} already registered \u2014 confirmed matching`);
   return `${items.length} namespace${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
 }
+function scriptTally(items) {
+  if (items.length === 0) return null;
+  const created = items.filter((i) => i.action === "created");
+  const superseded = items.filter((i) => i.action === "superseded");
+  const unchanged = items.length - created.length - superseded.length;
+  const seg = [];
+  if (created.length) seg.push(`${created.length} first version${created.length === 1 ? "" : "s"} pushed`);
+  if (superseded.length) {
+    seg.push(`${superseded.map((i) => `'${i.name}'`).join(", ")} superseded (a new version now current)`);
+  }
+  if (unchanged) seg.push(`${unchanged} already current \u2014 nothing written`);
+  return `${items.length} script${items.length === 1 ? "" : "s"} (${seg.join("; ")})`;
+}
 function applyOutcomeSummary(result) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
@@ -17868,13 +19949,34 @@ function applyOutcomeSummary(result) {
     // 'reconciled' mean the same "updated to match" as every other kind here.
     reconcileTally(result.issuerActions, "issuer"),
     namespaceTally(result.namespaceActions),
+    // Scripts — reported BEFORE triggers, mirroring the order they are provisioned in, and with
+    // their own wording because "reconciled" would be a lie: a script version is immutable.
+    scriptTally(result.scriptActions),
+    // Trigger rules — 'reconciled' means the same "upsert applied the declared shape" as
+    // schemas/roles (createTrigger's own upsert:true reconcile), so the shared reconcileTally
+    // wording applies unchanged; buildPlan's dry-run preview already discloses each trigger's own
+    // steps individually, this is the apply-time tally counterpart.
+    reconcileTally(result.triggerActions, "trigger"),
     `profile ${result.profileAction}`
   ].filter((p) => p !== null);
   const detail = parts.length ? ` \u2014 ${parts.join("; ")}` : "";
   const principalNote = result.userAction === "reconciled" ? `  \u26A0 service principal already existed in this tenant before this run (not newly created)
 ` : "";
+  const pruneNotes = result.triggerPrunes.map(
+    (p) => `  \u26A0 trigger '${p.name}' removed from the blueprint \u2014 de-provisioned (rule + access profile deleted)
+` + // Not a warning: 404 on the profile means it was already gone, so the end state is exactly
+    // what a clean prune produces. Said out loud only so the absent second delete isn't read as
+    // a silent skip. Every OTHER profile-delete failure lands in triggerPruneSkipped instead.
+    (p.profileDeleted ? "" : `    (its access profile was already absent \u2014 nothing left to remove)
+`)
+  ).join("");
+  const pruneSkippedNotes = result.triggerPruneSkipped.map(
+    (s) => s.name ? `  \u26A0 trigger '${s.name}' is no longer declared but could NOT be removed \u2014 ${s.reason}. It is still live.
+` : `  \u26A0 triggers could not be reconciled this run \u2014 ${s.reason}. A trigger removed from this blueprint may still be live.
+`
+  ).join("");
   return `  \u2714 context '${result.contextId}' ${result.contextAction}${detail}
-${principalNote}`;
+${principalNote}${pruneNotes}${pruneSkippedNotes}`;
 }
 var BOOTSTRAP_HELP = `vectros bootstrap \u2014 provision a least-privilege MCP credential.
 
@@ -18073,7 +20175,7 @@ ${BOOTSTRAP_HELP}
         process.stderr.write(`
   \u2716 Scope gate refused blueprint '${blueprint.name}':
 `);
-        for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+        for (const r of err.rejected) process.stderr.write(`      \u2022 ${formatRejection(r)}
 `);
         process.stderr.write("  Minting nothing.\n");
         return 2;
@@ -18082,7 +20184,7 @@ ${BOOTSTRAP_HELP}
         process.stderr.write(`
   \u2716 Capability gate refused blueprint '${blueprint.name}':
 `);
-        for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+        for (const r of err.rejected) process.stderr.write(`      \u2022 ${formatRejection(r)}
 `);
         process.stderr.write("  Minting nothing.\n");
         return 2;
@@ -18396,71 +20498,6 @@ ${formatCliError(err, { action: "Bootstrap failed" })}`);
 // src/cli-blueprint.ts
 import { writeFile as writeFile2, access } from "fs/promises";
 
-// src/scope-grammar.ts
-var FORBIDDEN_SCOPE_NAMESPACES2 = /* @__PURE__ */ new Set([
-  "user",
-  "record",
-  "document",
-  "entity",
-  "self",
-  "tenant",
-  "context",
-  "scope",
-  "versions",
-  "lookup"
-]);
-var SCOPE_NAMESPACE_RE2 = /^[a-z][a-z0-9_-]{1,31}$/;
-var SCOPE_NAMESPACE_MIN_LENGTH = 2;
-var SCOPE_NAMESPACE_MAX_LENGTH = 32;
-var SCOPE_VALUE_RE2 = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-var SCOPE_VALUE_MIN_LENGTH = 1;
-var SCOPE_VALUE_MAX_LENGTH = 128;
-function valueGrammarError(value) {
-  if (!SCOPE_VALUE_RE2.test(value)) {
-    return `'${value}' is not a valid scope value \u2014 ${SCOPE_VALUE_MIN_LENGTH}-${SCOPE_VALUE_MAX_LENGTH} characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'. A value may not contain a colon.`;
-  }
-  return null;
-}
-function namespaceGrammarError(ns) {
-  if (FORBIDDEN_SCOPE_NAMESPACES2.has(ns)) {
-    return `'${ns}' is a reserved namespace and cannot be used as an ownership scope`;
-  }
-  if (!SCOPE_NAMESPACE_RE2.test(ns)) {
-    return `'${ns}' is not a valid namespace \u2014 lowercase, ${SCOPE_NAMESPACE_MIN_LENGTH}-${SCOPE_NAMESPACE_MAX_LENGTH} characters, starting with a letter and continuing with letters, digits, '_' or '-'`;
-  }
-  return null;
-}
-function assertScopeEntries(entries, flag) {
-  if (!entries?.length) return;
-  for (const raw of entries) {
-    const sep = raw.indexOf(":");
-    if (sep <= 0 || sep === raw.length - 1) {
-      throw new Error(`${flag} must be '<namespace>:<value>' (e.g. 'org:6ba7...'); got '${raw}'.`);
-    }
-    const nsError = namespaceGrammarError(raw.slice(0, sep));
-    if (nsError) throw new Error(`${flag} namespace ${nsError}`);
-    const valError = valueGrammarError(raw.slice(sep + 1));
-    if (valError) throw new Error(`${flag} value ${valError}`);
-  }
-}
-function assertIdentityOverrideValues(overrides, flag) {
-  if (!overrides) return;
-  for (const [key, value] of Object.entries(overrides)) {
-    if (!key.startsWith("scope:")) continue;
-    const error = valueGrammarError(typeof value === "string" ? value : String(value));
-    if (error) throw new Error(`${flag} '${key}' value ${error}`);
-  }
-}
-function placeholderScopeNamespace(value) {
-  const self2 = /^\$\{\{\s*(?:under\.)?self\.scope\.([^\s}]+)\s*\}\}$/.exec(value);
-  if (self2) return self2[1];
-  const member = MEMBER_SCOPE_PLACEHOLDER_RE2.exec(value);
-  return member ? member[1] : null;
-}
-var SELF_PLACEHOLDER_RE = /^\$\{\{\s*self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
-var UNDER_SELF_PLACEHOLDER_RE2 = /^\$\{\{\s*under\.self\.(?:userId|partnerUserId|scope\.[a-z][a-z0-9_-]{1,31})\s*\}\}$/;
-var MEMBER_SCOPE_PLACEHOLDER_RE2 = /^\$\{\{\s*member\.scope\.([a-z][a-z0-9_-]{1,31})(?::[a-z][a-z0-9_-]{1,31})?\s*\}\}$/;
-
 // src/lint.ts
 var ENUM_COMPATIBLE_TYPES = /* @__PURE__ */ new Set(["enum", "string", "string[]"]);
 var BUILT_IN_SORT_BY = /* @__PURE__ */ new Set(["createdAt", "lastUpdated"]);
@@ -18609,7 +20646,7 @@ function lintBlueprint(bp) {
     );
   }
   for (const roleId of Object.keys(bp.roles ?? {})) {
-    if (!ROLE_ID_RE.test(roleId)) {
+    if (!ROLE_ID_RE3.test(roleId)) {
       findings.push({
         severity: "error",
         rule: "role-id-format",
@@ -18656,7 +20693,7 @@ function lintBlueprint(bp) {
   }
   return findings;
 }
-var ROLE_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
+var ROLE_ID_RE3 = /^[a-z][a-z0-9-]{2,30}$/;
 var PLACEHOLDER_SHAPED_RE = /^\s*\$\{\{.*\}\}\s*$/s;
 var RECOGNIZED_PLACEHOLDER_RES = [
   /^\$\{\{\s*any\s*\}\}$/,
@@ -18922,14 +20959,14 @@ async function resolveAndValidate(arg, verb, supplied) {
     if (err instanceof ScopeGateError) {
       process.stderr.write(`  \u2716 Scope gate rejected '${blueprint.name}':
 `);
-      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${formatRejection(r)}
 `);
       return null;
     }
     if (err instanceof CapabilityGateError) {
       process.stderr.write(`  \u2716 Capability gate rejected '${blueprint.name}':
 `);
-      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${formatRejection(r)}
 `);
       return null;
     }
@@ -19073,137 +21110,44 @@ async function runBlueprintCli(argv, deps = {}) {
     args = parseBlueprintArgs(argv);
   } catch (err) {
     process.stderr.write(`${err instanceof Error ? err.message : String(err)}
-
-${BLUEPRINT_HELP}
-`);
-    return 1;
-  }
-  if (args.help) {
-    process.stdout.write(`${BLUEPRINT_HELP}
-`);
-    return 0;
-  }
-  if (!args.sub) {
-    process.stdout.write(`${BLUEPRINT_HELP}
-`);
-    return 1;
-  }
-  switch (args.sub) {
-    case "init":
-      return runInit(args);
-    case "validate":
-      return runValidate(args);
-    case "plan":
-      return runPlan(args);
-    case "list":
-      return runList();
-    default:
-      process.stderr.write(
-        `Unknown blueprint subcommand: ${args.sub}. Bundled: ${BLUEPRINT_NAMES.join(", ")}
-
-${BLUEPRINT_HELP}
-`
-      );
-      return 1;
-  }
-}
-
-// src/program.ts
-import { Command, Option } from "commander";
-
-// src/verb-support.ts
-async function withAuth(opts, deps, body) {
-  const log = deps.log ?? createLogger2();
-  const resolveAuth = deps.resolveAuth ?? resolveAuthContext;
-  let auth;
-  try {
-    auth = await resolveAuth({
-      env: opts.env,
-      baseUrl: opts.baseUrl,
-      token: opts.token,
-      context: opts.context,
-      provisioning: opts.provisioning,
-      tenant: opts.tenant,
-      useScopedToken: opts.useScopedToken,
-      log
-    });
-  } catch (err) {
-    if (err instanceof MissingCredentialError) {
-      process.stderr.write(`  \u2716 ${err.message}
-`);
-      return 2;
-    }
-    process.stderr.write(`  \u2716 ${formatError(err)}
-`);
-    return 1;
-  }
-  return body(auth, log);
-}
-function requireTenantId(auth) {
-  if (!auth.tenantId) {
-    throw new Error(
-      "Could not resolve tenantId from /v1/ping \u2014 the extended ping (tenant_id) must be deployed."
-    );
-  }
-  return auth.tenantId;
-}
-function normalizePrincipalUserId(principal) {
-  return principal.startsWith("usr_") ? principal.slice("usr_".length) : principal;
-}
-function splitCsv(csv) {
-  return csv.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-}
-function parseScopeOverrides(scopes) {
-  if (!scopes || scopes.length === 0) return void 0;
-  const out = {};
-  for (const raw of scopes) {
-    const sep = raw.indexOf(":");
-    if (sep <= 0 || sep === raw.length - 1) {
-      throw new Error(`--scope must be '<namespace>:<value>' (e.g. 'org:6ba7...'); got '${raw}'.`);
-    }
-    const ns = raw.slice(0, sep);
-    const value = raw.slice(sep + 1);
-    const valueError = valueGrammarError(value);
-    if (valueError) throw new Error(`--scope value ${valueError}`);
-    const key = `scope:${ns}`;
-    if (Object.prototype.hasOwnProperty.call(out, key)) {
-      throw new Error(`--scope sets namespace '${ns}' more than once \u2014 a scope override takes at most one value per namespace.`);
-    }
-    out[key] = value;
-  }
-  if (Object.keys(out).length > 2) {
-    throw new Error("--scope allows at most two distinct namespaces.");
-  }
-  return out;
-}
-function parseJsonObjectFlag(flag, raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error(`${flag} is not valid JSON: ${raw}`);
+
+${BLUEPRINT_HELP}
+`);
+    return 1;
   }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(`${flag} must be a JSON object (e.g. '{"userId":["<id>"]}').`);
+  if (args.help) {
+    process.stdout.write(`${BLUEPRINT_HELP}
+`);
+    return 0;
   }
-  return parsed;
-}
+  if (!args.sub) {
+    process.stdout.write(`${BLUEPRINT_HELP}
+`);
+    return 1;
+  }
+  switch (args.sub) {
+    case "init":
+      return runInit(args);
+    case "validate":
+      return runValidate(args);
+    case "plan":
+      return runPlan(args);
+    case "list":
+      return runList();
+    default:
+      process.stderr.write(
+        `Unknown blueprint subcommand: ${args.sub}. Bundled: ${BLUEPRINT_NAMES.join(", ")}
 
-// src/paginate.ts
-var PAGE_LIMIT = 100;
-async function drainPages(fetch2) {
-  const out = [];
-  let startFrom;
-  for (; ; ) {
-    const page = await fetch2(startFrom);
-    if (page.data) out.push(...page.data);
-    const next = page.nextCursor;
-    if (!next) break;
-    startFrom = next;
+${BLUEPRINT_HELP}
+`
+      );
+      return 1;
   }
-  return out;
 }
 
+// src/program.ts
+import { Command, Option } from "commander";
+
 // src/self-principal.ts
 var PRINCIPAL_PREFIX_USER = "usr_";
 function emailFromJwt(token) {
@@ -20221,7 +22165,14 @@ function normalizeClauses(raw) {
       });
       if (!isRecognizedOwnershipKey(k)) unrecognizedDims.push(k);
     }
-    out.push({ actions: Array.isArray(actions) ? actions.map(String) : [], dataScope, unrecognizedDims });
+    const rawAssignable = obj.assignable_roles ?? obj.assignableRoles;
+    const assignableRoles = Array.isArray(rawAssignable) && rawAssignable.length > 0 ? rawAssignable.map(String) : void 0;
+    out.push({
+      actions: Array.isArray(actions) ? actions.map(String) : [],
+      dataScope,
+      unrecognizedDims,
+      ...assignableRoles ? { assignableRoles } : {}
+    });
   }
   return out;
 }
@@ -20421,7 +22372,10 @@ async function runAccessExplain(opts, deps = {}) {
               dataScope: renderDataScope(c.dataScope),
               // Present only on a dead clause — an unrecognized dim the platform
               // denies (a retired key or a bad scope:<ns>); the matrix omits it.
-              ...c.unrecognizedDims.length > 0 ? { grantsNothing: true, unrecognizedDims: c.unrecognizedDims } : {}
+              ...c.unrecognizedDims.length > 0 ? { grantsNothing: true, unrecognizedDims: c.unrecognizedDims } : {},
+              // Reported only when the clause actually carries the restriction. Absent means
+              // default-open (any role composable), which is a different fact from an empty list.
+              ...c.assignableRoles?.length ? { assignableRoles: c.assignableRoles } : {}
             })),
             matrix: rows,
             // Present only when a clause uses `${{ under.self.* }}`: those rows are UNDECIDED
@@ -20447,6 +22401,12 @@ async function runAccessExplain(opts, deps = {}) {
         if (c.unrecognizedDims.length > 0) {
           process.stdout.write(
             `       \u2716 grants nothing \u2014 unrecognized dimension${c.unrecognizedDims.length > 1 ? "s" : ""}: ${c.unrecognizedDims.join(", ")} (the platform denies a clause keyed on any dim that is not userId or a valid scope:<namespace>)
+`
+          );
+        }
+        if (c.assignableRoles?.length) {
+          process.stdout.write(
+            `       may compose only these roles into a delegated profile: ${c.assignableRoles.join(", ")}
 `
           );
         }
@@ -20512,6 +22472,14 @@ async function runRoleCreate(opts, deps = {}) {
       return 2;
     }
   }
+  let assignableRoles;
+  try {
+    assignableRoles = parseAssignableRoles(opts.assignableRole);
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
   return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
     try {
@@ -20524,7 +22492,15 @@ async function runRoleCreate(opts, deps = {}) {
           // data_scope is included only when supplied — the clause wire shape
           // stays byte-identical for unscoped roles.
           scopes: [
-            dataScope ? { allowed_actions: actions, data_scope: dataScope } : { allowed_actions: actions }
+            {
+              allowed_actions: actions,
+              // Each included only when supplied — the clause wire shape stays byte-identical for an
+              // unscoped, unrestricted role. `assignable_roles` in particular must be OMITTED rather
+              // than sent empty: the platform reads absent as "no roleId restriction" and rejects
+              // `[]` outright, so the two are not interchangeable.
+              ...dataScope ? { data_scope: dataScope } : {},
+              ...assignableRoles ? { assignable_roles: assignableRoles } : {}
+            }
           ],
           // Included only when supplied — omitting it (rather than sending an
           // empty object) keeps "no assume grant" and "explicitly empty grant"
@@ -20783,6 +22759,36 @@ function parseSelfSignupPolicies(raw) {
     return { signup_type: entry.slice(0, sep), role_id: entry.slice(sep + 1) };
   });
 }
+var MAX_CAPTURED_CLAIMS2 = 20;
+var MAX_CAPTURED_CLAIM_NAME_LENGTH2 = 64;
+function parseCapturedClaims(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  if (raw.length > MAX_CAPTURED_CLAIMS2) {
+    throw new Error(
+      `--captured-claim accepts at most ${MAX_CAPTURED_CLAIMS2} entries; got ${raw.length}.`
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of raw) {
+    if (name.trim().length === 0) {
+      throw new Error("--captured-claim must be a non-blank OIDC claim name (e.g. 'phone_number').");
+    }
+    if (name.length > MAX_CAPTURED_CLAIM_NAME_LENGTH2) {
+      throw new Error(
+        `--captured-claim '${name}' is ${name.length} characters, above the ${MAX_CAPTURED_CLAIM_NAME_LENGTH2}-character limit.`
+      );
+    }
+    if (seen.has(name)) {
+      throw new Error(`--captured-claim repeats '${name}' \u2014 each claim name may be given only once.`);
+    }
+    seen.add(name);
+  }
+  return [...raw];
+}
+function renderCapturedClaims(claims) {
+  if (!claims || claims.length === 0) return "\u2014";
+  return claims.join(", ");
+}
 function renderSelfSignup(policies) {
   if (!policies || policies.length === 0) return "\u2014";
   return policies.map((p) => `${p.signup_type} \u2192 ${p.role_id}`).join(", ");
@@ -20799,7 +22805,8 @@ function renderIssuer(i) {
     ["userinfoUri", i.userinfoUri],
     ["status", i.status],
     ["createdAt", i.createdAt],
-    ["selfSignup", renderSelfSignup(i.selfSignupPolicies)]
+    ["selfSignup", renderSelfSignup(i.selfSignupPolicies)],
+    ["capturedClaims", renderCapturedClaims(i.capturedClaims)]
   ]);
 }
 async function runIssuersList(opts, deps = {}) {
@@ -20820,7 +22827,8 @@ async function runIssuersList(opts, deps = {}) {
           { header: "issuer", get: (i) => i.issuer },
           { header: "audience", get: (i) => i.audience },
           { header: "status", get: (i) => i.status },
-          { header: "self-signup", get: (i) => renderSelfSignup(i.selfSignupPolicies) }
+          { header: "self-signup", get: (i) => renderSelfSignup(i.selfSignupPolicies) },
+          { header: "captured claims", get: (i) => renderCapturedClaims(i.capturedClaims) }
         ]) + "\n"
       );
       return 0;
@@ -20852,8 +22860,10 @@ ${renderIssuer(issuer)}
 }
 async function runIssuersRegister(opts, deps = {}) {
   let selfSignupPolicies;
+  let capturedClaims;
   try {
     selfSignupPolicies = parseSelfSignupPolicies(opts.selfSignupPolicy);
+    capturedClaims = parseCapturedClaims(opts.capturedClaim);
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
@@ -20871,7 +22881,8 @@ async function runIssuersRegister(opts, deps = {}) {
         subClaim: opts.subClaim,
         emailClaim: opts.emailClaim,
         userinfoUri: opts.userinfoUri,
-        selfSignupPolicies
+        selfSignupPolicies,
+        capturedClaims
       });
       if (opts.json) {
         process.stdout.write(`${formatJson(issuer)}
@@ -20892,8 +22903,10 @@ ${renderIssuer(issuer)}
 }
 async function runIssuersUpdate(opts, deps = {}) {
   let selfSignupPolicies;
+  let capturedClaims;
   try {
     selfSignupPolicies = parseSelfSignupPolicies(opts.selfSignupPolicy);
+    capturedClaims = parseCapturedClaims(opts.capturedClaim);
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
@@ -20905,6 +22918,12 @@ async function runIssuersUpdate(opts, deps = {}) {
     );
     return 2;
   }
+  if (opts.clearCapturedClaims && capturedClaims && capturedClaims.length > 0) {
+    process.stderr.write(
+      "  \u2716 --clear-captured-claims and --captured-claim are mutually exclusive.\n"
+    );
+    return 2;
+  }
   return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
     const client = auth.client;
     try {
@@ -20914,7 +22933,8 @@ async function runIssuersUpdate(opts, deps = {}) {
         emailClaim: opts.emailClaim,
         userinfoUri: opts.userinfoUri,
         status: opts.status,
-        selfSignupPolicies: opts.clearSelfSignupPolicies ? [] : selfSignupPolicies
+        selfSignupPolicies: opts.clearSelfSignupPolicies ? [] : selfSignupPolicies,
+        capturedClaims: opts.clearCapturedClaims ? [] : capturedClaims
       });
       if (opts.json) {
         process.stdout.write(`${formatJson(issuer)}
@@ -20973,41 +22993,264 @@ async function runIssuersDelete(opts, deps = {}) {
     try {
       await client.auth.deleteIssuer({ issuerId });
       if (opts.json) {
-        process.stdout.write(`${formatJson({ issuerId, deleted: true })}
+        process.stdout.write(`${formatJson({ issuerId, deleted: true })}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 issuer '${issuerId}' deregistered from '${context}'
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "issuers delete failed" }));
+      return 1;
+    }
+  });
+}
+
+// src/commands/namespace.ts
+function renderNamespace(n) {
+  return formatKeyValues([
+    ["namespace", n.namespace],
+    ["contextId", n.contextId ?? "(tenant-wide)"],
+    ["entityBacked", n.entityBacked === void 0 ? void 0 : String(n.entityBacked)],
+    ["reserved", n.reserved === void 0 ? void 0 : String(n.reserved)],
+    ["specificityRank", n.specificityRank === void 0 ? void 0 : String(n.specificityRank)],
+    ["defaultSchemaId", n.defaultSchemaId],
+    ["createdAt", n.createdAt]
+  ]);
+}
+async function runNamespaceList(opts, deps = {}) {
+  return withAuth({ ...opts, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const rows = await drainPages(
+        (startFrom) => client.identity.listNamespaces({
+          limit: PAGE_LIMIT,
+          ...opts.context ? { contextId: opts.context } : {},
+          ...startFrom ? { startFrom } : {}
+        })
+      );
+      if (opts.json) {
+        process.stdout.write(`${formatJson(rows)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        "\n" + formatTable(rows, [
+          { header: "namespace", get: (n) => n.namespace },
+          { header: "contextId", get: (n) => n.contextId ?? "(tenant-wide)" },
+          {
+            header: "entityBacked",
+            get: (n) => n.entityBacked === void 0 ? void 0 : String(n.entityBacked)
+          },
+          {
+            header: "specificityRank",
+            get: (n) => n.specificityRank === void 0 ? void 0 : String(n.specificityRank)
+          }
+        ]) + "\n"
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "namespace list failed" }));
+      return 1;
+    }
+  });
+}
+async function runNamespaceGet(opts, deps = {}) {
+  return withAuth({ ...opts, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const ns = await client.identity.getNamespace({
+        namespace: opts.namespace,
+        ...opts.context ? { contextId: opts.context } : {}
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(ns)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+${renderNamespace(ns)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "namespace get failed" }));
+      return 1;
+    }
+  });
+}
+async function runNamespaceRegister(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const ns = await client.identity.registerNamespace({
+        contextId: opts.context,
+        body: {
+          namespace: opts.namespace,
+          specificityRank: opts.specificityRank,
+          entityBacked: opts.entityBacked,
+          defaultSchemaId: opts.defaultSchemaId
+        }
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson(ns)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 namespace '${opts.namespace}' registered
+${renderNamespace(ns)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "namespace register failed" }));
+      return 1;
+    }
+  });
+}
+
+// src/commands/scripts.ts
+import { readFile as readFile3 } from "fs/promises";
+import * as readline5 from "readline/promises";
+var SOURCE_MAX_BYTES = 3e5;
+var INPUT_CONTRACT_MAX_BYTES = 5e4;
+var utf8Bytes2 = (s) => new TextEncoder().encode(s).length;
+var SCRIPT_NAME_RE2 = /^[A-Za-z0-9_-]{1,64}$/;
+function renderScript(s, opts = {}) {
+  return formatKeyValues([
+    ["id", s.id],
+    ["name", s.name],
+    ["scriptVersion", s.scriptVersion === void 0 ? void 0 : String(s.scriptVersion)],
+    ["declaredInputContract", s.declaredInputContract],
+    ["createdAt", s.createdAt],
+    // Full source last, and only where it was asked for — it can be 300 KB.
+    ...opts.source && s.source !== void 0 ? [["source", s.source]] : []
+  ]);
+}
+async function runScriptsPush(opts, deps = {}) {
+  if (!SCRIPT_NAME_RE2.test(opts.name)) {
+    process.stderr.write(
+      `  \u2716 '${opts.name}' is not a valid script name \u2014 use 1-64 characters of letters, digits, underscores ('_') and hyphens ('-').
+`
+    );
+    return 2;
+  }
+  if (opts.inputContract !== void 0 && opts.inputContractFile !== void 0) {
+    process.stderr.write("  \u2716 --input-contract and --input-contract-file are mutually exclusive.\n");
+    return 2;
+  }
+  let source;
+  try {
+    source = await readFile3(opts.sourceFile, "utf8");
+  } catch (err) {
+    process.stderr.write(`  \u2716 could not read --source-file '${opts.sourceFile}': ${errText(err)}
+`);
+    return 2;
+  }
+  if (source.trim().length === 0) {
+    process.stderr.write(`  \u2716 --source-file '${opts.sourceFile}' is empty \u2014 'source' must not be blank.
+`);
+    return 2;
+  }
+  if (opts.inputContract !== void 0 && opts.inputContract.trim().length === 0) {
+    process.stderr.write(
+      `  \u2716 --input-contract is blank. Omit the flag to store no input contract at all \u2014 an empty one is not a contract.
+`
+    );
+    return 2;
+  }
+  let declaredInputContract = opts.inputContract;
+  if (opts.inputContractFile !== void 0) {
+    try {
+      declaredInputContract = await readFile3(opts.inputContractFile, "utf8");
+    } catch (err) {
+      process.stderr.write(
+        `  \u2716 could not read --input-contract-file '${opts.inputContractFile}': ${errText(err)}
+`
+      );
+      return 2;
+    }
+    if (declaredInputContract.trim().length === 0) {
+      process.stderr.write(
+        `  \u2716 --input-contract-file '${opts.inputContractFile}' is blank. Omit the flag to store no input contract at all \u2014 an empty one is not a contract.
+`
+      );
+      return 2;
+    }
+  }
+  const sourceBytes = utf8Bytes2(source);
+  if (sourceBytes > SOURCE_MAX_BYTES) {
+    process.stderr.write(
+      `  \u2716 source is ${sourceBytes.toLocaleString("en-US")} UTF-8 bytes, over the ${SOURCE_MAX_BYTES.toLocaleString("en-US")}-byte limit.
+`
+    );
+    return 2;
+  }
+  if (declaredInputContract !== void 0 && utf8Bytes2(declaredInputContract) > INPUT_CONTRACT_MAX_BYTES) {
+    process.stderr.write(
+      `  \u2716 input contract is ${utf8Bytes2(declaredInputContract).toLocaleString("en-US")} UTF-8 bytes, over the ${INPUT_CONTRACT_MAX_BYTES.toLocaleString("en-US")}-byte limit.
+`
+    );
+    return 2;
+  }
+  return withAuth(opts, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      if (opts.ifChanged) {
+        const latest = await readLatestScriptVersion(
+          client,
+          opts.name
+        );
+        if (latest !== void 0 && scriptMatches(latest, { source, declaredInputContract })) {
+          if (opts.json) {
+            process.stdout.write(`${formatJson({ ...latest, pushed: false })}
+`);
+            return 0;
+          }
+          process.stdout.write(
+            `
+  = script '${opts.name}' already matches at version ${latest.scriptVersion} \u2014 nothing pushed.
+`
+          );
+          return 0;
+        }
+      }
+      const pushed = await client.scripts.createScript({
+        name: opts.name,
+        source,
+        declaredInputContract
+      });
+      if (opts.json) {
+        process.stdout.write(`${formatJson({ ...pushed, pushed: true })}
 `);
         return 0;
       }
-      process.stdout.write(`
-  \u2714 issuer '${issuerId}' deregistered from '${context}'
-`);
+      process.stdout.write(
+        `
+  \u2714 pushed script '${opts.name}' version ${pushed.scriptVersion} (${sourceBytes.toLocaleString("en-US")} bytes) to '${opts.context}'
+${renderScript(pushed)}
+  A trigger rule reaches this with scriptRef { name: '${opts.name}', version: 'latest' }.
+  Pinning version '${pushed.scriptVersion}' instead keeps that rule on exactly this one \u2014
+  but only for a script pushed this way. A blueprint that SHIPS a script requires 'latest'
+  for it, since the blueprint cannot know which number its source will land on.
+`
+      );
       return 0;
     } catch (err) {
-      process.stderr.write(formatCliError(err, { action: "issuers delete failed" }));
+      process.stderr.write(formatCliError(err, { action: "scripts push failed" }));
       return 1;
     }
   });
 }
-
-// src/commands/namespace.ts
-function renderNamespace(n) {
-  return formatKeyValues([
-    ["namespace", n.namespace],
-    ["contextId", n.contextId ?? "(tenant-wide)"],
-    ["entityBacked", n.entityBacked === void 0 ? void 0 : String(n.entityBacked)],
-    ["reserved", n.reserved === void 0 ? void 0 : String(n.reserved)],
-    ["specificityRank", n.specificityRank === void 0 ? void 0 : String(n.specificityRank)],
-    ["defaultSchemaId", n.defaultSchemaId],
-    ["createdAt", n.createdAt]
-  ]);
-}
-async function runNamespaceList(opts, deps = {}) {
-  return withAuth({ ...opts, context: opts.context }, deps, async (auth) => {
+async function runScriptsList(opts, deps = {}) {
+  return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
     try {
       const rows = await drainPages(
-        (startFrom) => client.identity.listNamespaces({
+        (startFrom) => client.scripts.listScripts({
           limit: PAGE_LIMIT,
-          ...opts.context ? { contextId: opts.context } : {},
+          ...opts.name ? { name: opts.name } : {},
           ...startFrom ? { startFrom } : {}
         })
       );
@@ -21016,79 +23259,113 @@ async function runNamespaceList(opts, deps = {}) {
 `);
         return 0;
       }
+      if (rows.length === 0) {
+        process.stdout.write(
+          opts.name ? `
+  No versions of script '${opts.name}' in '${opts.context}'.
+` : `
+  No scripts in '${opts.context}'.
+`
+        );
+        return 0;
+      }
       process.stdout.write(
         "\n" + formatTable(rows, [
-          { header: "namespace", get: (n) => n.namespace },
-          { header: "contextId", get: (n) => n.contextId ?? "(tenant-wide)" },
-          {
-            header: "entityBacked",
-            get: (n) => n.entityBacked === void 0 ? void 0 : String(n.entityBacked)
-          },
-          {
-            header: "specificityRank",
-            get: (n) => n.specificityRank === void 0 ? void 0 : String(n.specificityRank)
-          }
+          { header: "name", get: (s) => s.name },
+          { header: "version", get: (s) => s.scriptVersion === void 0 ? void 0 : String(s.scriptVersion) },
+          { header: "id", get: (s) => s.id },
+          { header: "bytes", get: (s) => s.source === void 0 ? void 0 : String(utf8Bytes2(s.source)) },
+          { header: "createdAt", get: (s) => s.createdAt }
         ]) + "\n"
       );
       return 0;
     } catch (err) {
-      process.stderr.write(formatCliError(err, { action: "namespace list failed" }));
+      process.stderr.write(formatCliError(err, { action: "scripts list failed" }));
       return 1;
     }
   });
 }
-async function runNamespaceGet(opts, deps = {}) {
-  return withAuth({ ...opts, context: opts.context }, deps, async (auth) => {
+async function runScriptsGet(opts, deps = {}) {
+  return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
     try {
-      const ns = await client.identity.getNamespace({
-        namespace: opts.namespace,
-        ...opts.context ? { contextId: opts.context } : {}
-      });
+      const script = await client.scripts.getScript({ id: opts.id });
       if (opts.json) {
-        process.stdout.write(`${formatJson(ns)}
+        process.stdout.write(`${formatJson(script)}
 `);
         return 0;
       }
       process.stdout.write(`
-${renderNamespace(ns)}
+${renderScript(script, { source: true })}
 `);
       return 0;
     } catch (err) {
-      process.stderr.write(formatCliError(err, { action: "namespace get failed" }));
+      process.stderr.write(formatCliError(err, { action: "scripts get failed" }));
       return 1;
     }
   });
 }
-async function runNamespaceRegister(opts, deps = {}) {
-  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+async function runScriptsDelete(opts, deps = {}) {
+  process.stderr.write(
+    `
+  \u26A0 Deleting script version '${opts.id}' is permanent \u2014 the stored source is the only copy.
+    Other versions of the same name are unaffected.
+    Nothing checks whether a trigger rule still references this version. A rule pinned to it
+    will fail on every firing; a rule on 'latest' will silently fall back to the previous
+    version and keep running older code. This CLI cannot list trigger rules, so confirm
+    against the API or the portal before removing a version a rule may still use.
+    And if this is the name's LATEST version, its identity is REUSED: the next push of that
+    name recomputes the same version number and the same id, so anything holding a pinned
+    '${opts.id}' or a name@version reference will silently resolve to different source.
+
+`
+  );
+  if (!opts.force) {
+    const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+    if (!isTty) {
+      process.stderr.write(
+        `  \u2716 scripts delete is irreversible and needs an interactive confirmation.
+    Re-run with --force to delete '${opts.id}' without a prompt.
+`
+      );
+      return 2;
+    }
+    const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
+      const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
+      return { prompt: (q) => rl.question(q), close: () => rl.close() };
+    })();
+    try {
+      const typed = await promptCtx.prompt(`  Type the version id ('${opts.id}') to confirm: `);
+      if (typed.trim() !== opts.id) {
+        process.stderr.write(`  \u2716 Confirmation did not match \u2014 nothing deleted.
+`);
+        return 1;
+      }
+    } finally {
+      promptCtx.close();
+    }
+  }
+  return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
     try {
-      const ns = await client.identity.registerNamespace({
-        contextId: opts.context,
-        body: {
-          namespace: opts.namespace,
-          specificityRank: opts.specificityRank,
-          entityBacked: opts.entityBacked,
-          defaultSchemaId: opts.defaultSchemaId
-        }
-      });
+      await client.scripts.deleteScript({ id: opts.id });
       if (opts.json) {
-        process.stdout.write(`${formatJson(ns)}
+        process.stdout.write(`${formatJson({ id: opts.id, deleted: true })}
 `);
         return 0;
       }
-      process.stdout.write(`
-  \u2714 namespace '${opts.namespace}' registered
-${renderNamespace(ns)}
+      process.stdout.write(`  \u2714 Deleted script version '${opts.id}' from '${opts.context}'.
 `);
       return 0;
     } catch (err) {
-      process.stderr.write(formatCliError(err, { action: "namespace register failed" }));
+      process.stderr.write(formatCliError(err, { action: "scripts delete failed" }));
       return 1;
     }
   });
 }
+function errText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 
 // src/commands/assume.ts
 function parseAssumeScopes(raw) {
@@ -21111,11 +23388,20 @@ function parseAssumeScopes(raw) {
   return out;
 }
 function renderAssumeToken(t) {
-  return formatKeyValues([
+  const identity = t.resolvedScope?.identity;
+  const allowed = t.resolvedScope?.allowedActions;
+  const rows = [
     ["access_token", t.access_token],
     ["token_type", t.token_type],
     ["expires_in", t.expires_in === void 0 ? void 0 : `${t.expires_in}s`]
-  ]);
+  ];
+  if (identity && Object.keys(identity).length > 0) {
+    rows.push(["identity", Object.entries(identity).map(([k, v]) => `${k}=${v}`).join(", ")]);
+  }
+  if (allowed?.length) {
+    rows.push(["allowedActions", allowed.join(", ")]);
+  }
+  return formatKeyValues(rows);
 }
 async function runAssume(opts, deps = {}) {
   if (!opts.scope || opts.scope.length === 0) {
@@ -21300,12 +23586,14 @@ import { randomUUID as randomUUID2 } from "crypto";
 
 // src/harness.ts
 var errMsg = (e) => e instanceof Error ? e.message : String(e);
-var isNotFound = (e) => typeof e === "object" && e !== null && e.statusCode === 404;
+var isNotFound2 = (e) => typeof e === "object" && e !== null && e.statusCode === 404;
 var SNAPSHOT_PAGE_SIZE = 100;
 async function captureSnapshot(client, blueprint) {
   const existingSchemaTypes = /* @__PURE__ */ new Set();
   const existingProfilePrincipals = /* @__PURE__ */ new Set();
   const existingRoleIds = /* @__PURE__ */ new Set();
+  const existingTriggerNames = /* @__PURE__ */ new Set();
+  let triggerSnapshotFailed = false;
   let failed = false;
   try {
     let cursor;
@@ -21317,7 +23605,7 @@ async function captureSnapshot(client, blueprint) {
       cursor = next;
     }
   } catch (e) {
-    if (!isNotFound(e)) failed = true;
+    if (!isNotFound2(e)) failed = true;
   }
   try {
     let startFrom;
@@ -21333,7 +23621,7 @@ async function captureSnapshot(client, blueprint) {
       startFrom = next;
     }
   } catch (e) {
-    if (!isNotFound(e)) failed = true;
+    if (!isNotFound2(e)) failed = true;
   }
   try {
     let startFrom;
@@ -21349,9 +23637,23 @@ async function captureSnapshot(client, blueprint) {
       startFrom = next;
     }
   } catch (e) {
-    if (!isNotFound(e)) failed = true;
+    if (!isNotFound2(e)) failed = true;
+  }
+  if (Object.keys(blueprint.triggers ?? {}).length > 0) {
+    try {
+      let startFrom;
+      for (; ; ) {
+        const page = await client.triggers.listTriggers({ limit: SNAPSHOT_PAGE_SIZE, startFrom });
+        for (const t of page.data ?? []) if (t.name) existingTriggerNames.add(t.name);
+        const next = page.nextCursor;
+        if (!next) break;
+        startFrom = next;
+      }
+    } catch (e) {
+      if (!isNotFound2(e)) triggerSnapshotFailed = true;
+    }
   }
-  return { existingSchemaTypes, existingProfilePrincipals, existingRoleIds, failed };
+  return { existingSchemaTypes, existingProfilePrincipals, existingRoleIds, existingTriggerNames, triggerSnapshotFailed, failed };
 }
 async function captureIssuerSnapshot(bootstrapClient) {
   const existingIssuerIds = /* @__PURE__ */ new Set();
@@ -21547,6 +23849,97 @@ async function runTeardown(client, bootstrapClient, blueprint, machineId, snapsh
       steps.push({ step: `delete role ${roleId}`, ok: false, error: errMsg(e) });
     }
   }
+  const declaredTriggerNames = Object.keys(blueprint.triggers ?? {});
+  let allDeclaredTriggersDeleted = true;
+  if (declaredTriggerNames.length > 0) {
+    let live = [];
+    let listFailed = false;
+    try {
+      let startFrom;
+      for (; ; ) {
+        const page = await client.triggers.listTriggers({ limit: SNAPSHOT_PAGE_SIZE, startFrom });
+        live = live.concat(page.data ?? []);
+        const next = page.nextCursor;
+        if (!next) break;
+        startFrom = next;
+      }
+    } catch (e) {
+      listFailed = true;
+      steps.push({ step: "delete triggers", ok: false, error: `could not list triggers: ${errMsg(e)}` });
+      allDeclaredTriggersDeleted = false;
+    }
+    if (!listFailed) {
+      for (const name of declaredTriggerNames) {
+        if (snapshot.failed || snapshot.triggerSnapshotFailed) {
+          steps.push({ step: `delete trigger ${name}`, ok: true, skipped: true, error: "skipped \u2014 pre-apply snapshot failed; cannot prove ownership" });
+          allDeclaredTriggersDeleted = false;
+          continue;
+        }
+        if (snapshot.existingTriggerNames.has(name)) {
+          steps.push({ step: `delete trigger ${name}`, ok: true, skipped: true, error: "skipped \u2014 pre-existed this run" });
+          allDeclaredTriggersDeleted = false;
+          continue;
+        }
+        const row = live.find((t) => t.name === name);
+        if (!row?.id) {
+          steps.push({ step: `delete trigger ${name}`, ok: true, skipped: true, error: "skipped \u2014 not found (apply may not have reached it)" });
+          continue;
+        }
+        if (row.provisionedBy !== blueprint.name) {
+          steps.push({
+            step: `delete trigger ${name}`,
+            ok: true,
+            skipped: true,
+            error: `skipped \u2014 provisionedBy is ${row.provisionedBy ? `'${row.provisionedBy}'` : "unset"}, not this blueprint`
+          });
+          allDeclaredTriggersDeleted = false;
+          continue;
+        }
+        try {
+          await client.triggers.deleteTrigger({ id: row.id });
+          steps.push({ step: `delete trigger ${name}`, ok: true });
+        } catch (e) {
+          steps.push({ step: `delete trigger ${name}`, ok: false, error: errMsg(e) });
+          allDeclaredTriggersDeleted = false;
+          continue;
+        }
+        if (row.principalId) {
+          try {
+            await client.auth.deleteAccessProfile({ contextId: blueprint.contextId, principalId: row.principalId });
+            steps.push({ step: `delete trigger ${name} profile`, ok: true });
+          } catch (e) {
+            steps.push({ step: `delete trigger ${name} profile`, ok: false, error: errMsg(e) });
+          }
+        }
+      }
+    }
+  }
+  for (const script of result.scriptActions) {
+    if (!allDeclaredTriggersDeleted) {
+      steps.push({
+        step: `delete script ${script.name} v${script.scriptVersion}`,
+        ok: true,
+        skipped: true,
+        error: "skipped \u2014 a trigger rule this blueprint declares was not removed, so deleting the script it may reference could break a live rule silently"
+      });
+      continue;
+    }
+    if (script.action === "unchanged") {
+      steps.push({
+        step: `delete script ${script.name} v${script.scriptVersion}`,
+        ok: true,
+        skipped: true,
+        error: "skipped \u2014 this run pushed no version (the stored source already matched)"
+      });
+      continue;
+    }
+    try {
+      await client.scripts.deleteScript({ id: script.id });
+      steps.push({ step: `delete script ${script.name} v${script.scriptVersion}`, ok: true });
+    } catch (e) {
+      steps.push({ step: `delete script ${script.name} v${script.scriptVersion}`, ok: false, error: errMsg(e) });
+    }
+  }
   const toDelete = [];
   for (const [typeName, schemaId] of Object.entries(result.schemaIds)) {
     if (snapshot.failed) {
@@ -21633,7 +24026,9 @@ async function runBlueprintHarness(client, input, deps) {
         existingSchemaTypes: /* @__PURE__ */ new Set(),
         existingProfilePrincipals: /* @__PURE__ */ new Set(),
         existingRoleIds: /* @__PURE__ */ new Set(),
-        failed: !isNotFound(e)
+        existingTriggerNames: /* @__PURE__ */ new Set(),
+        triggerSnapshotFailed: !isNotFound2(e),
+        failed: !isNotFound2(e)
       };
     }
   } else {
@@ -21646,7 +24041,7 @@ async function runBlueprintHarness(client, input, deps) {
     try {
       issuerSnapshot = await captureIssuerSnapshot(await remintBootstrapForContext(blueprint.contextId));
     } catch (e) {
-      issuerSnapshot = { existingIssuerIds: /* @__PURE__ */ new Set(), failed: !isNotFound(e) };
+      issuerSnapshot = { existingIssuerIds: /* @__PURE__ */ new Set(), failed: !isNotFound2(e) };
     }
   } else {
     issuerSnapshot = await captureIssuerSnapshot(client);
@@ -21669,7 +24064,17 @@ async function runBlueprintHarness(client, input, deps) {
       log,
       provisioned,
       remintForContext,
-      remintBootstrapForContext
+      remintBootstrapForContext,
+      // CREATED-ONLY, and this is the seam that keeps it true for triggers. The loader's step 5d
+      // reconciles triggers by ABSENCE — it deletes rules this blueprint provisioned and no longer
+      // declares. That is right for a real bootstrap run, which owns its context; it is wrong here.
+      // This harness may run against a shared tenant, and its whole safety contract is that a run
+      // touches only what it CREATED: `captureSnapshot` protects pre-existing schemas, profiles,
+      // roles and issuers, and `runTeardown` skips them. There is no trigger leg in either, so a
+      // prune would delete a pre-existing trigger — and its access profile — with nothing
+      // recording that it happened and nothing able to restore it. Opt out rather than grow the
+      // snapshot a leg teardown could not honour anyway.
+      pruneTriggers: false
     });
     log.debug({ component: "harness", contextId: result.contextId, keyName: result.keyName }, "applied");
     assertions = await runAssertions(
@@ -21771,14 +24176,14 @@ async function runBlueprintTest(fileOrName, opts, deps = {}) {
     if (err instanceof ScopeGateError) {
       process.stderr.write(`  \u2716 Scope gate refused blueprint:
 `);
-      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${formatRejection(r)}
 `);
       return 2;
     }
     if (err instanceof CapabilityGateError) {
       process.stderr.write(`  \u2716 Capability gate refused blueprint:
 `);
-      for (const r of err.rejected) process.stderr.write(`      \u2022 ${r.action}: ${r.reason}
+      for (const r of err.rejected) process.stderr.write(`      \u2022 ${formatRejection(r)}
 `);
       return 2;
     }
@@ -22030,9 +24435,9 @@ function emitJoined(opts) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.20.0" : "dev",
-  sdk: true ? "0.42.0" : "dev",
-  blueprints: true ? "0.17.0" : "dev"
+  cli: true ? "0.21.0" : "dev",
+  sdk: true ? "0.43.0" : "dev",
+  blueprints: true ? "0.18.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -22043,6 +24448,9 @@ var KEY_FORMATS = ["human", "raw", "env", "json"];
 function collect(value, previous) {
   return [...previous, value];
 }
+function collectOptional(value, previous) {
+  return [...previous ?? [], value];
+}
 function addAuthOptions(cmd) {
   return cmd.addOption(
     new Option("--env <env>", "target environment").choices(["staging", "production"]).default("production").hideHelp()
@@ -22114,6 +24522,7 @@ function buildProgram(deps = {}) {
   registerContextCommands(program, deps);
   registerIssuersCommands(program, deps);
   registerNamespaceCommands(program, deps);
+  registerScriptsCommands(program, deps);
   registerAssumeCommand(program, deps);
   registerJoinCommand(program, deps);
   registerKeyringCommands(program);
@@ -22289,6 +24698,10 @@ function registerIssuersCommands(program, deps) {
     "opt-in self-service signup entry, repeatable (e.g. default:member) \u2014 no entry may target an elevated role",
     collect,
     []
+  ).option(
+    "--captured-claim <name>",
+    "additional OIDC claim to capture from this issuer\u2019s tokens beyond the email claim, repeatable (e.g. phone_number); omit to capture nothing beyond email",
+    collectOptional
   ).option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
   addCommonAuthOptions(register).action(
     async (flags) => {
@@ -22306,6 +24719,7 @@ function registerIssuersCommands(program, deps) {
             emailClaim: flags.emailClaim,
             userinfoUri: flags.userinfoUri,
             selfSignupPolicy: flags.selfSignupPolicy,
+            capturedClaim: flags.capturedClaim,
             tenant
           },
           deps
@@ -22318,7 +24732,11 @@ function registerIssuersCommands(program, deps) {
     "replace self-signup policies, repeatable (e.g. default:member) \u2014 omit entirely to leave unchanged",
     collect,
     []
-  ).option("--clear-self-signup-policies", "disable self-signup entirely (sends an empty list; XOR --self-signup-policy)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  ).option("--clear-self-signup-policies", "disable self-signup entirely (sends an empty list; XOR --self-signup-policy)").option(
+    "--captured-claim <name>",
+    "replace the additional OIDC claims captured beyond the email claim, repeatable \u2014 omit entirely to leave unchanged",
+    collectOptional
+  ).option("--clear-captured-claims", "capture nothing beyond the email claim (sends an empty list; XOR --captured-claim)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
   addCommonAuthOptions(update).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
@@ -22334,6 +24752,8 @@ function registerIssuersCommands(program, deps) {
             status: flags.status,
             selfSignupPolicy: flags.selfSignupPolicy,
             clearSelfSignupPolicies: Boolean(flags.clearSelfSignupPolicies),
+            capturedClaim: flags.capturedClaim,
+            clearCapturedClaims: Boolean(flags.clearCapturedClaims),
             tenant
           },
           deps
@@ -22395,6 +24815,68 @@ function registerNamespaceCommands(program, deps) {
     }
   );
 }
+function registerScriptsCommands(program, deps) {
+  const scripts = program.command("scripts").description("Manage script objects (the versioned JS source a trigger rule runs).");
+  const push = scripts.command("push").description("Store a new version of a script name (always creates a version unless --if-changed).").argument("<name>", "script name: 1-64 chars of letters, digits, '_' and '-'").requiredOption("--context <c>", "app context to push into").requiredOption("--source-file <path>", "file holding the script source (max 300,000 UTF-8 bytes)").option("--input-contract <text>", "free-text description of the expected input shape (descriptive only)").option("--input-contract-file <path>", "read the input contract from a file instead").option("--if-changed", "push nothing when the current version already carries this exact content").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
+  addCommonAuthOptions(push).action(
+    async (name, flags) => {
+      process.exit(
+        await runScriptsPush(
+          {
+            ...toCommonOptions(flags),
+            name,
+            context: flags.context,
+            sourceFile: flags.sourceFile,
+            inputContract: flags.inputContract,
+            inputContractFile: flags.inputContractFile,
+            ifChanged: Boolean(flags.ifChanged),
+            tenant: parseTenantFlag(flags.tenant)
+          },
+          deps
+        )
+      );
+    }
+  );
+  const list = scripts.command("list").description("List script versions \u2014 every version of one --name (oldest first), or all scripts (newest first).").requiredOption("--context <c>", "app context to read").option("--name <name>", "list every version of this script name instead of a flat cross-name list").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
+  addCommonAuthOptions(list).action(
+    async (flags) => {
+      process.exit(
+        await runScriptsList(
+          { ...toCommonOptions(flags), context: flags.context, name: flags.name, tenant: parseTenantFlag(flags.tenant) },
+          deps
+        )
+      );
+    }
+  );
+  const get = scripts.command("get").description("Show one script version, including its full source.").argument("<id>", "the script VERSION id (each version has its own)").requiredOption("--context <c>", "app context to read").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
+  addCommonAuthOptions(get).action(
+    async (id, flags) => {
+      process.exit(
+        await runScriptsGet(
+          { ...toCommonOptions(flags), id, context: flags.context, tenant: parseTenantFlag(flags.tenant) },
+          deps
+        )
+      );
+    }
+  );
+  const del = scripts.command("delete").description("Permanently delete ONE script version (other versions of the name are unaffected).").argument("<id>", "the script VERSION id").requiredOption("--context <c>", "app context to delete from").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option("--force", "skip the interactive confirmation (required in a non-interactive shell)");
+  addCommonAuthOptions(del).action(
+    async (id, flags) => {
+      process.exit(
+        await runScriptsDelete(
+          {
+            ...toCommonOptions(flags),
+            id,
+            context: flags.context,
+            tenant: parseTenantFlag(flags.tenant),
+            force: Boolean(flags.force)
+          },
+          deps
+        )
+      );
+    }
+  );
+}
 function registerRoleCommands(program, deps) {
   const role = program.command("role").description("Manage context-scoped roles (reusable scope rules; bind via `access grant --role`).");
   const create = role.command("create").description("Create (idempotent by roleId) a single-clause role from --actions.").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id (3-31 chars; lowercase letter + lowercase/digit/dash)").requiredOption("--name <name>", "human-readable name").requiredOption("--actions <csv>", "allowed actions, comma-separated (e.g. records:cru,search:r)").option(
@@ -22403,72 +24885,106 @@ function registerRoleCommands(program, deps) {
   ).option(
     "--assumable <json>",
     `role-level \`vectros assume\` grant \u2014 JSON map of scope:<namespace> \u2192 allowed values (e.g. '{"scope:org":["orgB"]}'); independent of --data-scope, never data_scope's grammar (userId cannot be named)`
-  ).option("--description <text>", "free-text description");
+  ).option(
+    "--assignable-role <roleId>",
+    'restrict WHICH roles this clause may compose into a delegated profile, repeatable \u2014 omit for no restriction (the default); the platform rejects an empty list, so there is no way to spell "compose nothing"',
+    collectOptional
+  ).option("--description <text>", "free-text description").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(create).action(
     async (flags) => {
-      process.exit(
-        await runRoleCreate({
-          ...toCommonOptions(flags),
-          context: flags.context,
-          roleId: flags.roleId,
-          name: flags.name,
-          actions: flags.actions,
-          dataScope: flags.dataScope,
-          assumable: flags.assumable,
-          description: flags.description
-        }, deps)
-      );
+      process.exitCode = await runRoleCreate({
+        ...toCommonOptions(flags),
+        tenant: parseTenantFlag(flags.tenant),
+        context: flags.context,
+        roleId: flags.roleId,
+        name: flags.name,
+        actions: flags.actions,
+        dataScope: flags.dataScope,
+        assumable: flags.assumable,
+        assignableRole: flags.assignableRole,
+        description: flags.description
+      }, deps);
     }
   );
-  const list = role.command("list").description("List the roles defined in a context.").requiredOption("--context <c>", "app context");
+  const list = role.command("list").description("List the roles defined in a context.").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(async (flags) => {
-    process.exit(await runRoleList({ ...toCommonOptions(flags), context: flags.context }, deps));
-  });
-  const get = role.command("get").description("Show one role by id.").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id");
-  addCommonAuthOptions(get).action(async (flags) => {
-    process.exit(await runRoleGet({ ...toCommonOptions(flags), context: flags.context, roleId: flags.roleId }, deps));
-  });
-  const del = role.command("delete").description("Delete a role (referencing profiles must be reassigned).").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id");
-  addAuthOptions(del).action(async (flags) => {
-    process.exit(await runRoleDelete({ ...toCommonOptions(flags), context: flags.context, roleId: flags.roleId }, deps));
+    process.exitCode = await runRoleList(
+      { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context },
+      deps
+    );
   });
+  const get = role.command("get").description("Show one role by id.").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
+  addCommonAuthOptions(get).action(
+    async (flags) => {
+      process.exitCode = await runRoleGet(
+        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, roleId: flags.roleId },
+        deps
+      );
+    }
+  );
+  const del = role.command("delete").description("Delete a role (referencing profiles must be reassigned).").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
+  addAuthOptions(del).action(
+    async (flags) => {
+      process.exitCode = await runRoleDelete(
+        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, roleId: flags.roleId },
+        deps
+      );
+    }
+  );
 }
 function registerAccessCommands(program, deps) {
   const access2 = program.command("access").description("Manage access bindings: principal \u2194 context \u2194 role/scopes.");
-  const grant = access2.command("grant").description("Bind a principal to a context via a role or inline actions.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--role <roleId>", "reference a Role (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions, comma-separated (XOR --role)").option("--scope <ns:value>", "identity override: a scope the principal acts under (repeatable, e.g. org:<id>)", collect, []).option("--identity-overrides <json>", "general identity overrides as a JSON object (merged over --scope)");
+  const grant = access2.command("grant").description("Bind a principal to a context via a role or inline actions.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--role <roleId>", "reference a Role (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions, comma-separated (XOR --role)").option("--scope <ns:value>", "identity override: a scope the principal acts under (repeatable, e.g. org:<id>)", collect, []).option("--identity-overrides <json>", "general identity overrides as a JSON object (merged over --scope)").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(grant).action(
     async (flags) => {
-      process.exit(
-        await runAccessGrant({
-          ...toCommonOptions(flags),
-          principal: flags.principal,
-          context: flags.context,
-          role: flags.role,
-          actions: flags.actions,
-          scope: flags.scope,
-          identityOverrides: flags.identityOverrides
-        }, deps)
+      process.exitCode = await runAccessGrant({
+        ...toCommonOptions(flags),
+        tenant: parseTenantFlag(flags.tenant),
+        principal: flags.principal,
+        context: flags.context,
+        role: flags.role,
+        actions: flags.actions,
+        scope: flags.scope,
+        identityOverrides: flags.identityOverrides
+      }, deps);
+    }
+  );
+  const revoke = access2.command("revoke").description("Remove a principal\u2019s binding in a context.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
+  addAuthOptions(revoke).action(
+    async (flags) => {
+      process.exitCode = await runAccessRevoke(
+        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        deps
+      );
+    }
+  );
+  const list = access2.command("list").description("List a context\u2019s members (--context) or a principal\u2019s contexts (--principal).").option("--context <c>", "list members of this context").option("--principal <p>", "list contexts this principal is bound to ('me' = your own user)").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
+  addCommonAuthOptions(list).action(
+    async (flags) => {
+      process.exitCode = await runAccessList(
+        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, principal: flags.principal },
+        deps
+      );
+    }
+  );
+  const get = access2.command("get").description("Show one principal\u2019s binding in a context.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
+  addCommonAuthOptions(get).action(
+    async (flags) => {
+      process.exitCode = await runAccessGet(
+        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        deps
+      );
+    }
+  );
+  const explain = access2.command("explain").description("Show what a principal\u2019s binding grants: its clauses + a concrete access matrix.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
+  addCommonAuthOptions(explain).action(
+    async (flags) => {
+      process.exitCode = await runAccessExplain(
+        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        deps
       );
     }
   );
-  const revoke = access2.command("revoke").description("Remove a principal\u2019s binding in a context.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context");
-  addAuthOptions(revoke).action(async (flags) => {
-    process.exit(await runAccessRevoke({ ...toCommonOptions(flags), principal: flags.principal, context: flags.context }, deps));
-  });
-  const list = access2.command("list").description("List a context\u2019s members (--context) or a principal\u2019s contexts (--principal).").option("--context <c>", "list members of this context").option("--principal <p>", "list contexts this principal is bound to ('me' = your own user)");
-  addCommonAuthOptions(list).action(async (flags) => {
-    process.exit(await runAccessList({ ...toCommonOptions(flags), context: flags.context, principal: flags.principal }, deps));
-  });
-  const get = access2.command("get").description("Show one principal\u2019s binding in a context.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context");
-  addCommonAuthOptions(get).action(async (flags) => {
-    process.exit(await runAccessGet({ ...toCommonOptions(flags), principal: flags.principal, context: flags.context }, deps));
-  });
-  const explain = access2.command("explain").description("Show what a principal\u2019s binding grants: its clauses + a concrete access matrix.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context");
-  addCommonAuthOptions(explain).action(async (flags) => {
-    process.exit(
-      await runAccessExplain({ ...toCommonOptions(flags), principal: flags.principal, context: flags.context }, deps)
-    );
-  });
 }
 function dimensionOption() {
   return new Option(