@vectros-ai/cli 0.24.0 → 0.26.0

package/dist/cli.js

@@ -1614,7 +1614,7 @@ var require_proper_lockfile = __commonJS({
 // src/cli-bootstrap.ts
 var readline2 = __toESM(require("readline/promises"));
 
-// node_modules/@vectros-ai/sdk/dist/index.mjs
+// ../../node_modules/@vectros-ai/sdk/dist/index.mjs
 var __defProp2 = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -1629,9 +1629,11 @@ __export(api_exports, {
   BatchWriteRequest: () => BatchWriteRequest,
   BatchWriteResult: () => BatchWriteResult,
   ChatMessage: () => ChatMessage,
+  ChatRequest: () => ChatRequest,
   ConflictError: () => ConflictError,
   ContentDeltaEvent: () => ContentDeltaEvent,
   ContentTooLargeError: () => ContentTooLargeError,
+  DocumentAskRequest: () => DocumentAskRequest,
   DocumentContextEvent: () => DocumentContextEvent,
   DocumentLookupRequest: () => DocumentLookupRequest,
   DocumentPatchRequest: () => DocumentPatchRequest,
@@ -1662,8 +1664,10 @@ __export(api_exports, {
   NotImplementedError: () => NotImplementedError,
   PaymentRequiredError: () => PaymentRequiredError,
   PingResponse: () => PingResponse,
+  RagRequest: () => RagRequest,
   RagSearch: () => RagSearch,
   ReadAccessLogResponse: () => ReadAccessLogResponse,
+  ReasoningDeltaEvent: () => ReasoningDeltaEvent,
   RecordLookupRequest: () => RecordLookupRequest,
   RecordRequest: () => RecordRequest,
   RecordResponse: () => RecordResponse,
@@ -2019,7 +2023,33 @@ var ListUsersRequestOrder = {
   Asc: "asc",
   Desc: "desc"
 };
+var ChatRequest;
+((ChatRequest2) => {
+  ChatRequest2.Reasoning = {
+    Omit: "omit",
+    Stream: "stream"
+  };
+})(ChatRequest || (ChatRequest = {}));
+var DocumentAskRequest;
+((DocumentAskRequest2) => {
+  DocumentAskRequest2.Reasoning = {
+    Omit: "omit",
+    Stream: "stream"
+  };
+})(DocumentAskRequest || (DocumentAskRequest = {}));
+var RagRequest;
+((RagRequest2) => {
+  RagRequest2.Reasoning = {
+    Omit: "omit",
+    Stream: "stream"
+  };
+})(RagRequest || (RagRequest = {}));
 var inference_exports = {};
+__export(inference_exports, {
+  ChatRequest: () => ChatRequest,
+  DocumentAskRequest: () => DocumentAskRequest,
+  RagRequest: () => RagRequest
+});
 var BatchWriteRequest;
 ((BatchWriteRequest2) => {
   BatchWriteRequest2.Atomicity = {
@@ -2292,6 +2322,12 @@ var ReadAccessLogResponse;
     Rag: "rag"
   };
 })(ReadAccessLogResponse || (ReadAccessLogResponse = {}));
+var ReasoningDeltaEvent;
+((ReasoningDeltaEvent2) => {
+  ReasoningDeltaEvent2.Event = {
+    ReasoningDelta: "reasoning_delta"
+  };
+})(ReasoningDeltaEvent || (ReasoningDeltaEvent = {}));
 var RecordRequest;
 ((RecordRequest2) => {
   RecordRequest2.Status = {
@@ -4044,7 +4080,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/jwks");
   }
   /**
-   * Returns a page of per-subject PHI read-access rows: who read which subject's PHI, when, against which record, and whether any sensitive value was actually revealed in plaintext. Metadata only — never the PHI itself. This is the disclosure-accounting surface from which a covered entity derives its HIPAA §164.528 accounting of disclosures. Provide at least one query axis: a subject (`subjectType` + `subjectId`) within a `contextId` for the primary accounting query; `resourceId` within a `contextId` for 'who read this record'; `callerKeyId` for 'what did this credential read' (account-wide forensic); or `contextId` alone to enumerate a whole context. `from`/`to` bound the time window. Results are scoped to your account, derived from your token — never from input. Requires the `access-log:r` scope.
+   * Returns a page of per-subject PHI read-access rows: who read which subject's PHI, when, against which record, and whether any sensitive value was actually revealed in plaintext. Metadata only — never the PHI itself. Rows exist only where read-access logging is enabled. Provide at least one query axis: a subject (`subjectType` + `subjectId`) within a `contextId` for the primary accounting query; `resourceId` within a `contextId` for 'who read this record'; `callerKeyId` for 'what did this credential read' (account-wide forensic); or `contextId` alone to enumerate a whole context. `from`/`to` bound the time window. Results are scoped to your account, derived from your token — never from input. Requires the `access-log:r` scope.
    *
    * @param {Vectros.GetAccessLogRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4186,7 +4222,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/admin/keys/scoped");
   }
   /**
-   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. Minting a key bound to your OWN principal needs nothing further; minting one bound to a DIFFERENT principal additionally requires the `delegate-mint` capability (`granted_capabilities`) on your credential — without it the request is refused. A root API key (`sk_`) is exempt from all three bounds. The profile you name must be `active` AND the user you name must not be `SUSPENDED`: either is refused with `409`, and no root exemption applies to that. Both refusals stop ISSUANCE only. Suspending the profile additionally stops credentials already bound to it, within about five minutes; suspending the user does not stop their existing keys at all. A `PENDING` user is fine.
+   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. Minting a key bound to your OWN principal needs nothing further; minting one bound to a DIFFERENT principal additionally requires the `delegate-mint` capability (`granted_capabilities`) on your credential — without it the request is refused. A root API key (`sk_`) is exempt from all three bounds. The profile you name must be `active` AND the user you name must not be `SUSPENDED`: either is refused with `409`, and no root exemption applies to that. Both refusals stop ISSUANCE only. Suspending the profile or the user additionally stops credentials already bound to it, within about five minutes. A `PENDING` user is fine.
    *
    * @param {Vectros.CreateScopedKeyRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4529,6 +4565,7 @@ var AuthClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -4581,6 +4618,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -4664,6 +4703,8 @@ var AuthClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.PaymentRequiredError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -4716,6 +4757,10 @@ var AuthClient = class {
           throw new PaymentRequiredError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -4804,6 +4849,7 @@ var AuthClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -4860,6 +4906,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -4950,6 +4998,7 @@ var AuthClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5000,6 +5049,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5146,13 +5197,14 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/app-contexts/{contextId}");
   }
   /**
-   * Updates an app context. This is a partial update: any field you omit (or send as null) keeps its existing value. The `contextId` is immutable and is taken from the URL path, so any `contextId` in the request body is ignored. Patchable fields: `name`, `description`, `companyName`; the per-principal metering trio (`meteringAxis`, `principalBurstLimit`, `principalUsageCap` — only takes effect for a partner with the corresponding account-level feature enabled); `readAccessLogDefault` (the PHI read-access-logging context default); and `identityProjectionClaims` (requires the platform provisioning capability on top of the ordinary scope below — see its own field description). Requires the `app-contexts:u` scope.
+   * Updates an app context. This is a partial update: any field you omit (or send as null) keeps its existing value. The `contextId` is immutable and is taken from the URL path, so any `contextId` in the request body is ignored. Patchable fields: `name`, `description`, `companyName`; the per-principal metering trio (`meteringAxis`, `principalBurstLimit`, `principalUsageCap` — only takes effect for an account with the corresponding feature enabled); `readAccessLogDefault` (the PHI read-access-logging context default); and `identityProjectionClaims` (requires the platform provisioning capability on top of the ordinary scope below — see its own field description). Requires the `app-contexts:u` scope.
    *
    * @param {Vectros.UpdateAppContextRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5201,6 +5253,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5357,6 +5411,7 @@ var AuthClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5409,6 +5464,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5434,6 +5491,7 @@ var AuthClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5476,6 +5534,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5749,7 +5809,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `userinfoUri`, `capturedClaims`, `restrictedToDomain` (a new non-blank value must already be a VERIFIED domain for your account; an empty string clears it back to domain-less; see `IssuerUpdateRequest.restrictedToDomain` for the full semantics), `status` (`active`/`suspended` — a registration awaiting verification (`pending_verification`) accepts no status change until it is verified; a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. **`subClaim` is identity-determining, not merely cosmetic**: it names which verified JWT claim is read as the federated user's identifier, so changing it on an issuer that already has bound users would silently re-identify (or, under self-signup, orphan) every one of them — changing it is therefore refused once any user has bound through this issuer, the same guard `DELETE` already applies, and is only free before the first real login. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
+   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `userinfoUri`, `capturedClaims`, `restrictedToDomain` (a new non-blank value must already be a VERIFIED domain for your account; an empty string clears it where permitted; see `IssuerUpdateRequest.restrictedToDomain` for the full semantics), `status` (`active`/`suspended` — a registration awaiting verification (`pending_verification`) accepts no status change until it is verified; a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. **`subClaim` is identity-determining, not merely cosmetic**: it names which verified JWT claim is read as the federated user's identifier, so changing it on an issuer that already has bound users would silently re-identify (or, under self-signup, orphan) every one of them — changing it is therefore refused once any user has bound through this issuer, the same guard `DELETE` already applies, and is only free before the first real login. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
    *
    * @param {Vectros.IssuerUpdateRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5757,6 +5817,7 @@ var AuthClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5803,6 +5864,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5816,7 +5879,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. This is unconditional on the affected users' `status`: suspending them first does not lift the refusal. **A bound registration cannot be replaced, self-service, within its own app context**: registering a replacement issuer under a different issuerId in the SAME context also fails, because the context's one-active-issuer claim is released only when THIS registration is deleted. Two real options: suspend this issuer (stops new exchanges immediately) and register a replacement under a DIFFERENT app context — note that targets a different context, so this context's existing users/roles/access profiles are not carried over; or contact your platform operator, who can force-release this registration so a replacement may be registered in the SAME context under a new issuerId. **The operator path is not a lighter-weight alternative to the first — it PERMANENTLY RETIRES this issuerId and leaves every bound user unable to ever exchange through it again; it does not preserve continuity for them any better than registering under a different context does.** An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. This is unconditional on the affected users' `status`: suspending them first does not lift the refusal. **A bound registration cannot be replaced, self-service, within its own app context**: registering a replacement issuer under a different issuerId in the SAME context also fails, because the context's one-active-issuer claim is released only when THIS registration is deleted. Two real options: suspend this issuer (stops new exchanges immediately) and register a replacement under a DIFFERENT app context — note that targets a different context, so this context's existing users/roles/access profiles are not carried over; or contact support, who can force-release this registration so a replacement may be registered in the SAME context under a new issuerId. **The support path is not a lighter-weight alternative to the first — it PERMANENTLY RETIRES this issuerId and leaves every bound user unable to ever exchange through it again; it does not preserve continuity for them any better than registering under a different context does.** An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
    *
    * @param {Vectros.DeleteIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5942,7 +6005,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
   }
   /**
-   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. A registration without `restrictedToDomain` is created `pending_verification` with a one-time challenge (`verificationClaim`, `verificationNonce`, `verificationExpiresAt`) and accepts no token until you prove you control the issuer with `POST /v1/auth/issuers/{issuerId}/verify`; it claims no `(issuer, audience)` pair until then, so registering never reveals whether another tenant holds one. A registration scoped to an already-verified domain with `restrictedToDomain` is `active` at once. Idempotent by `issuerId` within your tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`. Optionally name `restrictedToDomain` to scope this registration's (issuer, audience) uniqueness to a specific VERIFIED domain rather than the bare pair — see that field's own description. A domain-scoped registration proves control of the DOMAIN, not of the issuer itself: it routes only tokens carrying that domain's `hd` claim.
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. A registration without `restrictedToDomain` is created `pending_verification` with a one-time challenge (`verificationClaim`, `verificationNonce`, `verificationExpiresAt`) and accepts no token until you prove you control the issuer with `POST /v1/auth/issuers/{issuerId}/verify`; it claims no `(issuer, audience)` pair until then, so registering never reveals whether another tenant holds one. A registration scoped to an already-verified domain with `restrictedToDomain` is `active` at once. Idempotent by `issuerId` within your tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts, each via its own registration row with a distinct `audience`. Optionally name `restrictedToDomain` to scope this registration's (issuer, audience) uniqueness to a specific VERIFIED domain rather than the bare pair — see that field's own description. A domain-scoped registration proves control of the DOMAIN, not of the issuer itself: it routes only tokens carrying that domain's `hd` claim.
    *
    * @param {Vectros.IssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6351,6 +6414,7 @@ var AuthClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -6398,6 +6462,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -6497,6 +6563,7 @@ var AuthClient = class {
    * @throws {@link Vectros.UnauthorizedError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ContentTooLargeError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -6541,6 +6608,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 413:
+          throw new ContentTooLargeError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -6559,7 +6628,7 @@ var ComplianceClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Submits a right-to-erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure removes exactly the data the subject solely owns across the declared contexts, plus its identity and lookup rows when all contexts are covered. It never touches another account's data and never cascades into another subject's data. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
+   * Submits an erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure deletes the records, documents, folders and record schemas the subject solely owns across the declared contexts (and, for a user, its access profiles there), plus its identity and lookup rows when all contexts are covered. Rows co-owned with another owner scope or principal are kept; read-access log entries are not erased. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
    *
    * @param {Vectros.ErasureRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6622,7 +6691,7 @@ var ComplianceClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/erasure-requests");
   }
   /**
-   * Polls an erasure request by id. While the job is still running this returns its status only; once it completes, the response also includes the verifiable completion certificate (which contexts were swept, per-context deletion counts, whether the identity was kept, and reports of dangling references and shared rows left intact). Requires a root API key.
+   * Polls an erasure request by id. While the job is still running this returns its status only; once it completes, the response also includes the completion certificate (which contexts were swept, per-context deletion counts, whether the identity was kept, and reports of dangling references and shared rows left intact). Requires a root API key.
    *
    * @param {Vectros.GetErasureRequestRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6680,7 +6749,7 @@ var ComplianceClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/erasure-requests/{id}");
   }
   /**
-   * Submits an asynchronous job to export your account's data, or a single end-subject's data, across the requested contexts. The request returns 202 with an `exportJobId`; poll `GET /v1/admin/export/{id}` until the job completes to obtain a short-lived presigned download URL and a manifest describing the payload. Requires a root API key — a scoped credential is rejected with 403.
+   * Reserved: with a root API key this operation answers `501` and starts no job. The request and response shapes are published so that integrations can be written against them: a request names the contexts, or a single end-subject, to export, and the response carries an `exportJobId` that `GET /v1/admin/export/{id}` reports on. Requires a root API key — a scoped credential is rejected with 403.
    *
    * @param {Vectros.ExportRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6741,7 +6810,7 @@ var ComplianceClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/admin/export");
   }
   /**
-   * Polls an export job by id. While the job is still running this returns its status only; once it completes, the response also includes a short-lived presigned download URL and a manifest (format version and per-context counts). Requires a root API key.
+   * Reserved: with a root API key this operation answers `501`. Its response shape is the one the export operation above refers to: the job status, and a short-lived presigned download URL and a manifest (format version and per-context counts) for a completed job. Requires a root API key.
    *
    * @param {Vectros.GetExportRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6872,6 +6941,8 @@ var DocumentsClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -6923,6 +6994,10 @@ var DocumentsClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -7070,6 +7145,7 @@ var DocumentsClient = class {
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -7109,6 +7185,8 @@ var DocumentsClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -7401,7 +7479,7 @@ var DocumentsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/documents/{id}/download");
   }
   /**
-   * Returns the document's full text body when it is retained: always available for text-ingested documents, and for file-uploaded documents unless they were uploaded with `storeText=false` (which discards the extracted text once indexing completes — the original file remains available via `GET /{id}/download`). Returns 404 when the document does not exist, its text was not retained, or extraction has not yet completed. Requires the `documents:r` scope.
+   * Returns the document's full text body when it is retained: retained for text-ingested documents, and for file-uploaded documents unless they were uploaded with `storeText=false` (which discards the extracted text once indexing completes — the original file remains available via `GET /v1/documents/{id}/download`). Returns 404 when the document does not exist, its text was not retained, or extraction has not yet completed. Requires the `documents:r` scope.
    *
    * @param {Vectros.GetDocumentTextRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7521,6 +7599,7 @@ var DocumentsClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -7570,6 +7649,8 @@ var DocumentsClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -7653,6 +7734,8 @@ var FoldersClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -7702,6 +7785,10 @@ var FoldersClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -7777,6 +7864,7 @@ var FoldersClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -7824,6 +7912,8 @@ var FoldersClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -7844,6 +7934,7 @@ var FoldersClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -7885,6 +7976,8 @@ var FoldersClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -7898,7 +7991,7 @@ var FoldersClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/folders/{id}");
   }
   /**
-   * Partially updates a folder using an RFC 7386 JSON Merge Patch. The `name`, `description`, and ownership fields (`userId`, `scopes`) are applied when present and left unchanged when omitted; sending any of these as null is rejected, because clearing a field is not supported in this release (omit it instead). `slug` and `parentFolderId` are immutable — a folder cannot be re-slugged or moved via the API — and the request is rejected if either is present. Pass `expectedVersion` for optimistic concurrency (you get a 409 if the folder changed since you last read it). Requires the `folders:u` scope.
+   * Partially updates a folder using an RFC 7386 JSON Merge Patch. The `name`, `description`, and ownership fields (`userId`, `scopes`) are applied when present and left unchanged when omitted; sending any of these as null is rejected, because clearing a field is not supported (omit it instead). `slug` and `parentFolderId` are immutable — a folder cannot be re-slugged or moved via the API — and the request is rejected if either is present. Pass `expectedVersion` for optimistic concurrency (you get a 409 if the folder changed since you last read it). Requires the `folders:u` scope.
    *
    * @param {Vectros.PatchFolderRequest} request
    * @param {FoldersClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8121,6 +8214,8 @@ var IdentityClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8173,6 +8268,10 @@ var IdentityClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -8253,6 +8352,7 @@ var IdentityClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8305,6 +8405,8 @@ var IdentityClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -8324,6 +8426,7 @@ var IdentityClient = class {
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8368,6 +8471,8 @@ var IdentityClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -8591,6 +8696,7 @@ var IdentityClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8642,6 +8748,8 @@ var IdentityClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -8662,6 +8770,7 @@ var IdentityClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8706,6 +8815,8 @@ var IdentityClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -8770,7 +8881,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces");
   }
   /**
-   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary partner-grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and `contextId` is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). `org` and `client` are reserved names, registered the same way as any other namespace.
+   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and `contextId` is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). `org` and `client` are reserved names, registered the same way as any other namespace.
    *
    * @param {Vectros.RegisterNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8912,6 +9023,7 @@ var IdentityClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -8961,6 +9073,8 @@ var IdentityClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -9029,13 +9143,14 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/{id}");
   }
   /**
-   * Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The `type` field is immutable after creation, and `email` cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries `inviteToken`, `externalSubject`, and `emailVerifiedAttestation=true` completes the invitation. **`externalSubject` set this way is NOT an authentication binding and does not enable sign-in anywhere** — not the Vectros DevPortal/Admin App/web apps, and not `/v1/auth/token/exchange` either; both are granted only by the invitee authenticating themselves. If the invitee needs dev-portal/web-app access, send them the invitation link and let them accept it directly. If the invitee needs to sign in via token exchange, have them redeem `inviteToken` themselves at `/v1/auth/token/exchange` with their own credential — Vectros verifies it there and computes its own value for this field from the verified credential. The value you send here is stored exactly as-is, with no normalization, and does NOT automatically match or deduplicate against what a later token-exchange sign-in computes for the same real-world identity. Call this endpoint directly only if you run your own backend and want Vectros to record which of your own users a given account corresponds to — treat this field as informational for that purpose, not as a way to pre-authorize sign-in. Requires the `users:u` scope.
+   * Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The `type` field is immutable after creation, and `email` cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries `inviteToken`, `externalSubject`, and `emailVerifiedAttestation=true` completes the invitation. **`externalSubject` set this way is NOT an authentication binding and does not enable sign-in anywhere** — not the Vectros DevPortal/Admin App/web apps, and not `/v1/auth/token/exchange` either; both are granted only by the invitee authenticating themselves. A subject stored through `PUT /v1/users/{id}` does not make the person a member of your account: it is ignored for the tenant claims in sign-in tokens, the developer portal's memberships list and tenant switching, and an ownership transfer. To give such a person access, delete the user and invite them again; accepting the invitation binds the subject and counts it. If the invitee needs dev-portal/web-app access, send them the invitation link and let them accept it directly. If the invitee needs to sign in via token exchange, have them redeem `inviteToken` themselves at `/v1/auth/token/exchange` with their own credential — Vectros verifies it there and computes its own value for this field from the verified credential. The value you send here is stored exactly as-is, with no normalization, and does NOT automatically match or deduplicate against what a later token-exchange sign-in computes for the same real-world identity. Call this endpoint directly only if you run your own backend and want Vectros to record which of your own users a given account corresponds to — treat this field as informational for that purpose, not as a way to pre-authorize sign-in. Requires the `users:u` scope.
    *
    * @param {Vectros.UpdateUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -9083,6 +9198,8 @@ var IdentityClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -9344,7 +9461,7 @@ var InferenceClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns every inference model available to you, including each model's context window, the plan tiers it's available on, and the exact credit rates charged per 1K input and output tokens. Use this to populate model pickers and to validate a request before calling `/v1/chat`, `/v1/rag`, or `/v1/documents/{id}/ask`.
+   * Returns the whole platform model catalog, whatever your plan: `availableOn` names each model's plan tiers. Each entry also carries the context window and the credit rates per 1K input and output tokens: `regionPricing.base` for global-region requests, `regionPricing.us` for default requests, and `longContext` for prompts over its threshold. A model reached through a `providerAlias` is not listed. Use this to populate model pickers and to validate a request before calling `/v1/chat`, `/v1/rag`, or `/v1/documents/{id}/ask`.
    *
    * @param {InferenceClient.RequestOptions} requestOptions - Request-specific configuration.
    *
@@ -9388,7 +9505,7 @@ var InferenceClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/models");
   }
   /**
-   * Streams a model response as Server-Sent Events (SSE). Send the full conversation history in the `messages` array; a message with role `system` is extracted and used as the system prompt. Token cost is debited from your pre-paid inference balance (in cents), and a small per-call flat fee is debited from your monthly platform credit allowance. Requires the `inference:r` scope.
+   * Streams a model response as Server-Sent Events (SSE). Send the full conversation history in the `messages` array; a message with role `system` is extracted and used as the system prompt. On a pre-paid account, token cost is debited from your inference balance; usage-billed accounts accrue it for post-billing. A request routed through your own `providerAlias` incurs no Vectros token cost. A small per-call flat fee is charged to your monthly credit allowance, except when the call fails on the server side. Requires the `inference:r` scope.
    */
   chatInference(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__chatInference(request, requestOptions));
@@ -9441,8 +9558,14 @@ var InferenceClient = class {
           throw new PaymentRequiredError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 413:
+          throw new ContentTooLargeError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        case 503:
+          throw new ServiceUnavailableError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -9516,6 +9639,8 @@ var InferenceClient = class {
           throw new ContentTooLargeError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        case 503:
+          throw new ServiceUnavailableError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -9580,10 +9705,16 @@ var InferenceClient = class {
           throw new PaymentRequiredError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 413:
+          throw new ContentTooLargeError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         case 500:
           throw new InternalServerError(_response.error.body, _response.rawResponse);
+        case 503:
+          throw new ServiceUnavailableError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -9661,7 +9792,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/records/batch-get");
   }
   /**
-   * Reserved endpoint for batch lookup and reference resolution. The published response shape correlates results to each input and carries a per-item status envelope. It currently returns 501 (not implemented). The documented 200 response schema is the stable shape this endpoint will use once available. Requires the `records:r` scope.
+   * Reserved endpoint for batch lookup and reference resolution. With the `records:r` scope it answers 501 (not implemented). The published response shape correlates results to each input and carries a per-item status envelope. Requires the `records:r` scope.
    *
    * @param {Vectros.BatchLookupRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -9722,7 +9853,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/records/lookup/batch");
   }
   /**
-   * Writes up to 50 records (or 50 with `atomicity: all_or_nothing`) in a single request. Each item in `items` has exactly the same shape, and goes through exactly the same validation, authorization and idempotency rules, as the body of a single `POST /v1/records` — including schema validation, `externalId` idempotency, unique-field enforcement, and the `records:c:<type>` scope check, which is applied per item against that item's own record type. A batch is not a way to write a type your credential could not write one at a time.
+   * Writes up to 50 records per request in `best_effort` mode and up to 50 with `atomicity: all_or_nothing`, in a single request. Each item in `items` has exactly the same shape, and goes through exactly the same validation, authorization and idempotency rules, as the body of a single `POST /v1/records` — including schema validation, `externalId` idempotency, unique-field enforcement, and the `records:c:<type>` scope check, which is applied per item against that item's own record type. A batch is not a way to write a type your credential could not write one at a time.
    *
    * `atomicity` selects how the batch commits. `best_effort` (the default) writes each item independently: some can succeed while others fail, and each item's own outcome is reported. `all_or_nothing` commits every item in one transaction — if any item fails, no record is created or updated at all, and every item that was itself fine reports `not_committed` while the ones that failed report why. Because the transaction is bounded by the number of underlying storage rows rather than by the number of records, a large `all_or_nothing` batch can be refused as too large to commit atomically even when it is within the item limit; the error says so, and nothing is written when it happens.
    *
@@ -9861,6 +9992,8 @@ var RecordsClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -9917,6 +10050,10 @@ var RecordsClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -10065,6 +10202,7 @@ var RecordsClient = class {
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -10104,6 +10242,8 @@ var RecordsClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -10117,7 +10257,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/records/{id}");
   }
   /**
-   * Partially updates a record using an RFC 7386 JSON Merge Patch. The `payload` object is deep-merged into the existing payload: keys you send overwrite (recursing into nested objects), a key set to null is deleted, and keys you omit are left unchanged — so you can change a single field without re-sending the rest (unlike the full-replacement PUT). Top-level fields (`status`, `folderId`, `userId`, `scopes`) are set when present and left unchanged when omitted; sending a top-level field as null is rejected (clearing a top-level field is not supported in this release — omit it instead). `typeName`, `schemaId`, `externalId`, and `indexMode` are immutable and rejected if present. The merged result is validated against the schema. Pass `expectedVersion` to make the patch conditional (optimistic concurrency, 409 on conflict). Requires the `records:u:<type>` scope.
+   * Partially updates a record using an RFC 7386 JSON Merge Patch. The `payload` object is deep-merged into the existing payload: keys you send overwrite (recursing into nested objects), a key set to null is deleted, and keys you omit are left unchanged — so you can change a single field without re-sending the rest (unlike the full-replacement PUT). Top-level fields (`status`, `folderId`, `userId`, `scopes`) are set when present and left unchanged when omitted; sending a top-level field as null is rejected (clearing a top-level field is not supported — omit it instead). `typeName`, `schemaId`, `externalId`, and `indexMode` are immutable and rejected if present. The merged result is validated against the schema. Pass `expectedVersion` to make the patch conditional (optimistic concurrency, 409 on conflict). Requires the `records:u:<type>` scope.
    *
    * @param {Vectros.PatchRecordRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10546,6 +10686,8 @@ var SchemasClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -10615,6 +10757,10 @@ var SchemasClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -10758,7 +10904,7 @@ var SchemasClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/schemas/{id}");
   }
   /**
-   * Permanently deletes a record schema. The request is refused with 409 if records of this type still exist — delete those records first, since every record must reference a live schema. The same applies to documents bound to this schema (for a schema declaring the `document` surface) — delete those documents first. A lineage base (a schema other schemas declare `basedOn`) also cannot be deleted while any such variant still exists — delete the variant schema(s) first. It is likewise refused while any trigger rule fires off this schema — delete those trigger rules first. Requires the `schemas:d` scope.
+   * Permanently deletes a record schema. The request is refused with 409 if records of this type still exist — delete those records first, since every record must reference a live schema. The same applies to documents bound to this schema (for a schema declaring the `document` surface) — delete those documents first. A lineage base (a schema other schemas declare `basedOn`) also cannot be deleted while any such variant still exists — delete the variant schema(s) first. It is likewise refused while any trigger rule fires off this schema — delete those trigger rules first — and, for a schema declaring the `user` or `entity` surface, while any user or entity bound to it still exists. Requires the `schemas:d` scope.
    *
    * @param {Vectros.DeleteSchemaRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10885,7 +11031,7 @@ var ScriptsClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Runs a script you previously pushed to `POST /v1/scripts`, under your own credential, and returns what it returned. Every write the script makes is buffered and committed as ONE transaction after the script finishes: either all of them land or none do, and the response is sent only after they have committed — so everything in `result` is committed state or the script's own computation over it. On any failure the body is the standard error envelope and nothing the script staged is committed: its rows are written only when the transaction commits, and a document body or a large payload is DECIDED at that point and WRITTEN to storage only after the commit, so an aborted execution leaves nothing behind. The one residual sits after a successful commit, outside this response: if storing a body fails then, the row exists and the body does not until the platform's repair lands — so a `200` guarantees the rows, and a document's text should be read before it is relied on.
+   * Runs a script you previously pushed to `POST /v1/scripts`, under your own credential, and returns what it returned. Every write the script makes is buffered and committed as ONE transaction after the script finishes: either all of them land or none do, and the response is sent only after they have committed — so everything in `result` is committed state or the script's own computation over it. On any failure the body is the standard error envelope and nothing the script staged is committed: its rows are written only when the transaction commits, and a document body or a large payload is DECIDED at that point and WRITTEN to storage only after the commit, so an aborted execution leaves nothing behind. The one residual sits after a successful commit, outside this response: if storing a body fails then, the row exists and the body may not — so a `200` guarantees the rows, and a document's text should be read before it is relied on.
    *
    * **Permission.** Requires the `scripts:x` scope — the permission to *execute* — separate from the `scripts:c` permission to push scripts. Bare `scripts:x` grants every script in the context; `scripts:x:<name>` grants exactly that script name, every version of it. Execution discloses no source, so `scripts:r` is not needed. Inside the script, every read and write is enforced by your credential's data scopes exactly as the equivalent REST call would be — `scripts:x` alone can read and write nothing.
    *
@@ -11499,6 +11645,8 @@ var TriggersClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -11556,6 +11704,10 @@ var TriggersClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -11632,6 +11784,7 @@ var TriggersClient = class {
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -11689,6 +11842,8 @@ var TriggersClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -11708,6 +11863,7 @@ var TriggersClient = class {
    * @param {TriggersClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -11747,6 +11903,8 @@ var TriggersClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -11877,7 +12035,7 @@ var RenderHintsSchema = import_zod.z.object({
   helpText: import_zod.z.string().optional(),
   // Marks this field as the record's headline (display) field — the linked
   // primary column in the records list + the title on the detail view. At most
-  // one per schema (the platform takes the first by order). Format passthrough →
+  // one per schema (the platform stores the hint and does not enforce one; the reference UI uses the first by order). Format passthrough →
   // SchemaRequest.renderHints[fieldId].displayField.
   displayField: import_zod.z.boolean().optional()
 }).strict();
@@ -12082,7 +12240,7 @@ var BlueprintSchemaSchema = import_zod.z.object({
   // (`lintNamespacedScopeArrays`) — this `.max(MAX_SCOPE_DIMENSIONS)` is
   // only the shape-level cap, not the grammar check.
   // With a scoped token these must be consistent with the profile's dataScope
-  // (a cross-consistency lint is deferred to the lint slice).
+  // (the lints here check each entry's grammar only, not that consistency).
   userId: import_zod.z.string().min(1).optional(),
   scopes: import_zod.z.array(import_zod.z.string().min(1)).max(MAX_SCOPE_DIMENSIONS).optional(),
   // The id of an existing schema this one is a CUSTOMIZATION of, when a schema
@@ -12448,8 +12606,8 @@ var IdentityDeclSchema = import_zod.z.object({
   kind: IdentityKindSchema,
   // safeDisplayString: `@vectros-ai/cli`'s `runBootstrapCli` and `blueprint plan` both print
   // this RAW to stdout ("~ <name> (<kind>) — external id '<externalId>'"), immediately before
-  // the "Apply this plan? [y/N]" confirmation gate itself — the highest-severity gap found in
-  // this pass, since it sits at the confirmation prompt's own disclosure text, not merely
+  // the "Apply this plan? [y/N]" confirmation gate itself — the highest-severity place to
+  // close, since it sits at the confirmation prompt's own disclosure text, not merely
   // somewhere upstream of it. `displayName` is wrapped too though not currently
   // rendered in any preview (defense-in-depth, matching this file's practice for its adjacent
   // sibling fields) — it does reach a platform API payload as an entity's `name`.
@@ -12795,7 +12953,7 @@ var SeedCommonShape = {
    * seeds resolve a `reference` against (across surfaces: a record seed may
    * reference a document seed by its externalId, and vice versa).
    * `safeDisplayString`: not currently rendered in a plan-preview line (same as this schema's
-   * `typeName` just above until this pass), but the same "costs nothing to close now" standard
+   * `typeName` just above), but the same "costs nothing to close" standard
    * applies — a short caller-supplied id, not free-form prose, so no YAML block-scalar
    * collision risk like `description`'s.
    */
@@ -13460,10 +13618,10 @@ var BlueprintSchema = import_zod.z.object({
   /** Stable blueprint id (the `--blueprint <name>` selector + idempotency key). */
   name: safeDisplayString(import_zod.z.string().min(1)),
   version: safeDisplayString(import_zod.z.string().min(1)),
-  // NOT safeDisplayString — deliberately, after that wrap broke a real, multi-line-authored
-  // blueprint's `description` in review. `description` is never interpolated into any
+  // NOT safeDisplayString — deliberately: that wrap breaks real, multi-line-authored
+  // blueprint `description`s. `description` is never interpolated into any
   // rendered plan-preview line (`buildPlan`'s header prints
-  // `name`/`version`/`contextId`, never `description` — confirmed by grep, not assumed), so
+  // `name`/`version`/`contextId`, never `description`), so
   // wrapping it protected a sink that does not exist. It also actively broke real content:
   // this is exactly the field authors reach for a YAML folded (`>`) or literal (`|`) block
   // scalar to write, and clip chomping (the YAML default) always leaves exactly one trailing
@@ -13478,9 +13636,8 @@ var BlueprintSchema = import_zod.z.object({
   /**
    * Human-readable app-context name; defaults to `MCP — <name>` (see {@link contextNameOf})
    * when absent. `safeDisplayString`: `contextNameOf` renders this raw into the FIRST line of
-   * every `buildPlan` summary (the `context '...' (...)` step) — a gap found after the rest
-   * of this file's forgery-character pass had already shipped; same shape as
-   * `name`/`version`/`description` right above it.
+   * every `buildPlan` summary (the `context '...' (...)` step); same shape as
+   * `name`/`version` right above it.
    */
   contextName: safeDisplayString(import_zod.z.string().min(1)).optional(),
   /**
@@ -13536,7 +13693,8 @@ var BlueprintSchema = import_zod.z.object({
    * alongside app-context/service-principal creation and issuers, BEFORE
    * schemas/seed (an `entityBacked` namespace's entities, and an
    * `allowedSurfaces: ['entity']` schema, both need the registration to
-   * already exist). `org`/`client` need no entry — they exist already.
+   * already exist). `org`/`client` are registered the same way as any other
+   * namespace: signup does not register them, so declare an entry for each you use.
    */
   namespaces: import_zod.z.array(BlueprintNamespaceSchema).optional(),
   /**
@@ -13574,9 +13732,8 @@ var BlueprintSchema = import_zod.z.object({
    */
   identityProjectionClaims: import_zod.z.array(
     // safeDisplayString: rendered raw into buildPlan's context step (`identity projection:
-    // [...]`) — same rendered-plan-preview shape as `capturedClaims` (its structural pair,
-    // and fixed alongside it originally), missed here in the first pass; same ordering rule
-    // applies (safeDisplayString's own `.refine` before the blank-name `.refine` below,
+    // [...]`) — same rendered-plan-preview shape as `capturedClaims` (its structural pair);
+    // the same ordering rule applies (safeDisplayString's own `.refine` before the blank-name `.refine` below,
     // both after `.max` since `.refine` returns a ZodEffects with no `.max`).
     safeDisplayString(
       import_zod.z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
@@ -13781,7 +13938,7 @@ function deriveSuffix(contextId) {
 var WHOLE_TOKEN_RE = /^\$\{\{\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*\}\}$/;
 var TOKEN_SCAN_RE = /\$\$\{\{|\$\{\{([\s\S]*?)\}\}|\$\{\{/g;
 var INNER_REF_RE = /^([A-Za-z_]\w*)\.([A-Za-z_]\w*)$/;
-var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under", "member"]);
+var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under", "member", "input"]);
 var DEFERRED_BARE_TOKENS = /* @__PURE__ */ new Set(["any"]);
 var DEFERRED_NS_ALTERNATION = [...DEFERRED_NAMESPACES].join("|");
 var DEFERRED_INNER_RE = new RegExp(
@@ -16350,14 +16507,14 @@ var COGNITO_ALLOWED_HOSTS = Object.values(PER_ENV).map(
 );
 var BAKED_CLIENT_IDS = {
   staging: "61hjvm25kkjb1eei8t2d3jkcl8",
-  // validated against deployed staging hosted UI (2026-06-05)
+  // deployed staging hosted UI client
   production: "63eipeedjv78q653k45niih46f"
-  // prod SSM /vectros/cli/client-id (validated 2026-06-24)
+  // deployed production hosted UI client
 };
 var MissingCognitoClientIdError = class extends Error {
   constructor(env) {
     super(
-      `No Cognito client id for '${env}'. Set VECTROS_COGNITO_CLIENT_ID (the public DeveloperUserPoolCliClientId from the deploy) \u2014 baking + a discovery endpoint are tracked follow-ups.`
+      `No Cognito client id for '${env}'. Set VECTROS_COGNITO_CLIENT_ID to the public client id of the sign-in app.`
     );
     this.name = "MissingCognitoClientIdError";
   }
@@ -16500,6 +16657,25 @@ async function clearSession(baseDir) {
     return false;
   }
 }
+var TokenEndpointError = class extends Error {
+  status;
+  /** The OAuth `error` field of a JSON error body (e.g. `invalid_grant`), when there is one. */
+  oauthError;
+  constructor(status, text) {
+    super(`token endpoint HTTP ${status}${text ? ` \u2014 ${stripControlCharacters(text, 500)}` : ""}`);
+    this.name = "TokenEndpointError";
+    this.status = status;
+    this.oauthError = oauthErrorOf(text);
+  }
+};
+function oauthErrorOf(text) {
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed.error === "string" ? parsed.error : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function postToken(config, body, fetchImpl) {
   const res = await fetchImpl(tokenEndpoint(config), {
     method: "POST",
@@ -16507,9 +16683,7 @@ async function postToken(config, body, fetchImpl) {
     body: body.toString()
   });
   const text = await res.text().catch(() => "");
-  if (!res.ok) {
-    throw new Error(`token endpoint HTTP ${res.status}${text ? ` \u2014 ${stripControlCharacters(text, 500)}` : ""}`);
-  }
+  if (!res.ok) throw new TokenEndpointError(res.status, text);
   try {
     return JSON.parse(text);
   } catch {
@@ -16525,32 +16699,56 @@ async function refreshTokens(config, refreshToken, fetchImpl = fetch) {
 
 // src/auth-context.ts
 var COGNITO_TOKEN_ENV = "VECTROS_BOOTSTRAP_TOKEN";
+function loginCommandFor(env) {
+  return env === "staging" ? "vectros login --env staging" : "vectros login";
+}
 var MissingCredentialError = class extends Error {
-  constructor() {
+  constructor(env) {
     super(
-      `No credential found. Set ${COGNITO_TOKEN_ENV} or pass --token (generate a token in the developer portal, or run \`vectros login\` once it ships).`
+      `No credential found. Run \`${loginCommandFor(env)}\` to sign in, or set ${COGNITO_TOKEN_ENV} or pass --token (generate a token in the developer portal).`
     );
     this.name = "MissingCredentialError";
   }
 };
+var SessionExpiredError = class extends Error {
+  constructor(env) {
+    super(
+      `Your Vectros login session has expired or was revoked. Run \`${loginCommandFor(env)}\` to sign in again.`
+    );
+    this.name = "SessionExpiredError";
+  }
+};
 function resolveCognitoTokenSync(explicit) {
   if (explicit && explicit.trim()) return explicit.trim();
   const fromEnv = process.env[COGNITO_TOKEN_ENV];
   if (fromEnv && fromEnv.trim()) return fromEnv.trim();
   return void 0;
 }
-async function resolveCognitoToken(env, explicit) {
+async function resolveCognitoToken(env, explicit, deps = { readSession, refreshTokens, saveSession }) {
   const sync = resolveCognitoTokenSync(explicit);
   if (sync) return sync;
-  const session = await readSession();
+  const session = await deps.readSession();
   if (session && session.env === env) {
     const config = resolveCognitoConfig(env);
-    const tokens = await refreshTokens(config, session.refreshToken);
+    let tokens;
+    try {
+      tokens = await deps.refreshTokens(config, session.refreshToken);
+    } catch (err) {
+      if (err instanceof TokenEndpointError && err.oauthError === "invalid_grant") throw new SessionExpiredError(env);
+      throw err;
+    }
+    if (tokens.refresh_token && tokens.refresh_token !== session.refreshToken) {
+      const stored = await deps.readSession().catch(() => void 0);
+      if (stored?.refreshToken === session.refreshToken) {
+        await deps.saveSession({ ...session, refreshToken: tokens.refresh_token }).catch(() => void 0);
+      }
+    }
     const bearer = tokens.id_token ?? tokens.access_token;
     if (bearer) return bearer;
   }
-  throw new MissingCredentialError();
+  throw new MissingCredentialError(env);
 }
+var DEFAULT_CONTEXT_ID = "default";
 async function resolveAuthContext(opts) {
   const baseUrl = envToBaseUrl(opts.env, opts.baseUrl ?? process.env.VECTROS_API_BASE_URL);
   const cognitoToken = await resolveCognitoToken(opts.env, opts.token);
@@ -16560,7 +16758,7 @@ async function resolveAuthContext(opts) {
     apiBaseUrl: baseUrl,
     tenant,
     ...opts.context ? { contextId: opts.context } : {}
-  }) : await mintContextToken({ cognitoToken, apiBaseUrl: baseUrl, contextId: opts.context ?? "default", tenant });
+  }) : await mintContextToken({ cognitoToken, apiBaseUrl: baseUrl, contextId: opts.context ?? DEFAULT_CONTEXT_ID, tenant });
   const client = new VectrosClient({ token: bridge.token, environment: baseUrl });
   const identity = await resolveIdentity({ log: opts.log, apiKey: bridge.token, environment: baseUrl });
   return {
@@ -17061,6 +17259,7 @@ function keyNameFor(pack, machineId) {
 }
 
 // src/identity-resolver.ts
+var IDENTITIES_TO_ENSURE_HEADING = "  Identities to ensure (idempotent by external id; a non-user entity lives with its namespace):";
 function userPayload(decl) {
   const meta = decl.metadata;
   if (decl.displayName === void 0) return meta;
@@ -17201,7 +17400,7 @@ async function withAuth(opts, deps, body) {
       log
     });
   } catch (err) {
-    if (err instanceof MissingCredentialError || err instanceof InvalidBaseUrlError || err instanceof InvalidCognitoRegionError) {
+    if (err instanceof MissingCredentialError || err instanceof SessionExpiredError || err instanceof InvalidBaseUrlError || err instanceof InvalidCognitoRegionError) {
       process.stderr.write(`  \u2716 ${err.message}
 `);
       return 2;
@@ -17668,13 +17867,11 @@ function toSdkFields(blueprint, schemaIndex) {
     searchable: f.searchable,
     filterable: f.filterable,
     // Forwarded explicitly, like every sibling here: this mapping is a named-property list, not a
-    // spread, so an unforwarded field is dropped SILENTLY rather than failing — which is what
-    // happened to `validation` before it was added below.
+    // spread, so an unforwarded field is dropped SILENTLY rather than failing.
     inline: f.inline,
     description: f.description,
     enumValues: mapEnumValues(f.enumValues),
-    // Format passthrough — the loader previously DROPPED this (the
-    // "smoking gun" toSdkFields mapped only six props). The platform
+    // Format passthrough. The platform
     // `SchemaRequest.FieldDef.validation` enforces these server-side. The
     // typed blueprint ValidationRules narrows the SDK's free-form Record.
     validation: f.validation,
@@ -17796,21 +17993,12 @@ async function provisionContext(client, input) {
   const { blueprint, allowTenantWideNamespaces = false, readExistingKey, confirmExistingPrincipal, log } = input;
   assertBlueprintGates(blueprint);
   assertTenantWideNamespacesAllowed(blueprint, allowTenantWideNamespaces);
-  const ctxResp = await client.auth.createAppContext({
-    body: {
-      contextId: blueprint.contextId,
-      name: contextNameOf(blueprint),
-      ...blueprint.identityProjectionClaims === void 0 ? {} : { identityProjectionClaims: blueprint.identityProjectionClaims }
-    }
-  });
-  const contextAction = actionOf(ctxResp.created);
-  log.debug({ component: "loader", contextId: blueprint.contextId, contextAction }, "app-context ensured");
   const user = await client.identity.createUser({
     body: {
       externalId: blueprint.servicePrincipal.externalId,
       type: "SERVICE",
       // SDK 0.18+ (identity-access rework): UserRequest's free-form attribute bag
-      // was renamed `metadata` → `payload`. Same semantics (arbitrary key/value).
+      // is `payload` (arbitrary key/value).
       payload: { displayName: blueprint.servicePrincipal.displayName }
     }
   });
@@ -17845,6 +18033,15 @@ async function provisionContext(client, input) {
       "existing-principal collision confirmed (or unwired) \u2014 proceeding with any further write to this principal"
     );
   }
+  const ctxResp = await client.auth.createAppContext({
+    body: {
+      contextId: blueprint.contextId,
+      name: contextNameOf(blueprint),
+      ...blueprint.identityProjectionClaims === void 0 ? {} : { identityProjectionClaims: blueprint.identityProjectionClaims }
+    }
+  });
+  const contextAction = actionOf(ctxResp.created);
+  log.debug({ component: "loader", contextId: blueprint.contextId, contextAction }, "app-context ensured");
   const needsContextPinnedBootstrap = (blueprint.namespaces ?? []).length > 0;
   const ctxBootstrapClient = needsContextPinnedBootstrap ? input.remintBootstrapForContext ? await input.remintBootstrapForContext(blueprint.contextId) : client : void 0;
   if (ctxBootstrapClient && input.remintBootstrapForContext) {
@@ -17975,7 +18172,7 @@ async function runLoader(client, input) {
       // them), so default to ['record'] when a blueprint omits it. The `as` keeps
       // the literal default assignable to the SDK's enum-array type.
       allowedSurfaces: s.allowedSurfaces ?? ["record"],
-      // Format passthrough — previously dropped by the loader. Ownership mirrors
+      // Format passthrough. Ownership mirrors
       // the SDK `SchemaRequest` shape 1:1: the principal `userId` plus `scopes`
       // (namespaced parent edges `<ns>:<value>`; the flat orgId/clientId fields are gone).
       renderHints: toRenderHintMap(s),
@@ -18353,14 +18550,14 @@ function renderPlanDataScope(ds) {
 function buildPlan(blueprint, opts = {}) {
   const steps = [];
   const projection = blueprint.identityProjectionClaims?.length ? `, identity projection: [${blueprint.identityProjectionClaims.join(", ")}]` : blueprint.identityProjectionClaims ? ", identity projection: disabled (empty list)" : "";
-  steps.push({
-    kind: "context",
-    summary: `context '${blueprint.contextId}' (${contextNameOf(blueprint)}${projection})`
-  });
   steps.push({
     kind: "principal",
     summary: `principal '${blueprint.servicePrincipal.externalId}' (SERVICE)`
   });
+  steps.push({
+    kind: "context",
+    summary: `context '${blueprint.contextId}' (${contextNameOf(blueprint)}${projection})`
+  });
   for (const ns of blueprint.namespaces ?? []) {
     const ownerNote = ns.tenantWide ? "TENANT-WIDE \u2014 visible to every context" : `owned by '${blueprint.contextId}'`;
     const entityNote = ns.entityBacked ? ", entity-backed" : "";
@@ -18826,10 +19023,8 @@ var OsKeychainSecretStore = class {
   }
   /**
    * `present` or `unknown` — **never `absent`**: impossible through `getPassword`,
-   * and held there by POLICY where other evidence exists. (An earlier opening
-   * claimed a "permanent property… not a conservative default someone should
-   * tighten later", which the rest of this very docstring then disowns — the
-   * widening procedure is spelled out below. State the real shape up front.)
+   * and held there by POLICY where other evidence exists (the widening procedure
+   * is spelled out below).
    *
    * Proving absence would require distinguishing "no such entry" from "I could not
    * read it", and that information does not survive the binding: `get_password` is
@@ -18849,7 +19044,7 @@ var OsKeychainSecretStore = class {
    * Linux collection `secret-tool` exits 1 while `getPassword` returns `null`, so
    * the D-Bus layer reports the fault faithfully and `.ok()` is what discards it.
    * A read with real error semantics could therefore make `absent` reachable — and
-   * `find_credentials` now HAS verified semantics on Linux: it throws
+   * `find_credentials` HAS verified semantics on Linux: it throws
    * `org.freedesktop.Secret.Error.IsLocked` against a locked collection (measured;
    * see {@link OsKeychainSecretStore.deleteSecret} for the transcript). That is why
    * `deleteSecret` may confirm a delete while this method may not.
@@ -18859,7 +19054,7 @@ var OsKeychainSecretStore = class {
    * PRUNABLE, which is a behaviour change this CLI has not taken, and Windows'
    * locked-store behaviour is unmeasured (it has no comparable lock state, so there
    * is nothing yet to observe). Verify per-platform before widening; do not infer it
-   * from a signature, which is exactly what produced the bug this replaced.
+   * from a signature.
    */
   async presence(ref) {
     try {
@@ -18890,10 +19085,8 @@ var OsKeychainSecretStore = class {
    *
    * MEASURED, not inferred — and the distinction is the whole point, because
    * {@link OsKeychainSecretStore.presence} rightly forbids inferring a locked
-   * store's behaviour from a `Result` signature ("that inference is exactly what
-   * produced the bug this replaced"), and an earlier version of THIS comment did
-   * precisely that, on the path that authorizes destruction. Being right by luck is
-   * not being right. Against a real locked collection (`node:24-alpine`, non-root,
+   * store's behaviour from a `Result` signature, and doing so on the path that
+   * authorizes destruction would be right only by luck. Against a real locked collection (`node:24-alpine`, non-root,
    * `dbus-run-session` + gnome-keyring, collection locked via
    * `org.freedesktop.Secret.Service.Lock`):
    *
@@ -18908,16 +19101,14 @@ var OsKeychainSecretStore = class {
    * cached handle to it. CI cannot pin this half — it unlocks the collection so the rest of
    * the suite can use it — so the evidence lives here rather than in a test.
    *
-   * The WINDOWS half of the same contract was assumed for seven review rounds and
-   * is now also measured (real Credential Manager, real binding, throwaway service,
-   * 2026-07-17): `findCredentials` enumerates `account` byte-for-byte as stored —
+   * The WINDOWS half of the same contract is also measured (real Credential Manager,
+   * real binding, throwaway service): `findCredentials` enumerates `account` byte-for-byte as stored —
    * case preserved, 48-char refs intact — a confirmed delete empties the
    * enumeration, and `deleteCredential` on a nonexistent ref returns the same
    * meaningless `false` as Linux. So the `.some(c => c.account === ref)` comparison
    * is sound on both measured platforms. Still unmeasured: a CI lane that runs this
-   * against the real Windows store on every MR — the dev-machine probe is a point
-   * measurement, not a regression gate. (Tracked internally; this file ships to
-   * public npm, so no tracker number here.)
+   * against the real Windows store on every change — the dev-machine probe is a point
+   * measurement, not a regression gate.
    *
    * ⚠️ THIS METHOD'S FAIL-CLOSED GUARANTEE IS AN UPSTREAM BEHAVIOURAL CONTRACT, NOT
    * SOMETHING THIS CODE ENFORCES. `@napi-rs/keyring` is pinned to an EXACT version
@@ -18987,11 +19178,11 @@ var CryptoFileSecretStore = class {
   /**
    * The salt is the one file whose loss is UNRECOVERABLE — every `.enc` is scrypt'd
    * against it, so replacing it silently re-keys the store and bricks them all. Two
-   * rules follow, both inherited from siblings that already paid for them:
+   * rules follow:
    *
    *   - A present-but-short salt is treated exactly like a corrupt index
    *     ({@link readKeyring}): throw an actionable error, never silently replace.
-   *     The old code regenerated it, which converts one anomaly into every secret
+   *     Regenerating it would convert one anomaly into every secret
    *     being permanently undecryptable — destruction dressed as repair.
    *   - Creation is temp + hard-link (atomic AND exclusive; below), with an
    *     exclusive-create (`wx`) fallback on no-hardlink filesystems. The link path
@@ -19073,7 +19264,7 @@ var CryptoFileSecretStore = class {
   async setSecret(ref, secret) {
     const key = await this.encryptionKey();
     const iv = (0, import_node_crypto3.randomBytes)(IV_LEN);
-    const cipher = (0, import_node_crypto3.createCipheriv)(ALGO, key, iv);
+    const cipher = (0, import_node_crypto3.createCipheriv)(ALGO, key, iv, { authTagLength: TAG_LEN });
     const enc = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
     const blob = Buffer.concat([iv, tag, enc]);
@@ -19096,7 +19287,7 @@ var CryptoFileSecretStore = class {
       const iv = blob.subarray(0, IV_LEN);
       const tag = blob.subarray(IV_LEN, IV_LEN + TAG_LEN);
       const enc = blob.subarray(IV_LEN + TAG_LEN);
-      const decipher = (0, import_node_crypto3.createDecipheriv)(ALGO, key, iv);
+      const decipher = (0, import_node_crypto3.createDecipheriv)(ALGO, key, iv, { authTagLength: TAG_LEN });
       decipher.setAuthTag(tag);
       return Buffer.concat([decipher.update(enc), decipher.final()]).toString("utf8");
     } catch {
@@ -19142,9 +19333,8 @@ var CryptoFileSecretStore = class {
    * EACCES, or the directory not being there AT ALL — answers false, i.e. "we know
    * nothing".
    *
-   * A MISSING `secrets/` reads as "we know nothing", not as an honest empty, and
-   * that is the opposite of what an earlier version concluded. The reasoning that
-   * looked right: nothing has ever been stored, so "no secret here" is true. Why it
+   * A MISSING `secrets/` reads as "we know nothing", not as an honest empty. The
+   * tempting reasoning — nothing has ever been stored, so "no secret here" is true —
    * is wrong: this is only ever consulted about an entry that is IN the index and
    * stamped `crypto-file` — meaning `setSecret` ran, and `setSecret` mkdir's
    * `secrets/` before every write. So for the only entries that reach here, "the
@@ -19155,7 +19345,7 @@ var CryptoFileSecretStore = class {
    * it went. Calling that `absent` invites `prune` to delete the entry and the only
    * record of a keyId whose key is still live.
    *
-   * The fresh-install case this used to serve is not lost: an install with nothing
+   * The fresh-install case needs no special handling: an install with nothing
    * stored has no index entries either, so nothing asks.
    */
   async secretsDirIntact() {
@@ -19272,10 +19462,9 @@ async function withIndexLock(dir, fn, timings = LOCK_OPTS) {
       // Swallowing is the better answer. We cannot un-write what we already wrote;
       // finishing is strictly better than crashing half-done.
       //
-      // What swallowing does NOT buy — and an earlier version of this comment
-      // claimed it did, with a "verified": the library marks a lock released when
-      // it DETECTS a compromise, and then our release below is a no-op that cannot
-      // delete a successor's lock. That detection runs on the mtime-refresh timer,
+      // What swallowing does NOT buy is protection from our own release: the library
+      // marks a lock released when it DETECTS a compromise, after which our release
+      // below would be a no-op that cannot delete a successor's lock. That detection runs on the mtime-refresh timer,
       // every `stale/2` — 2.5s at the shipping 5s — and this file's critical
       // sections are ~1ms, so in practice the holder is gone before the first tick
       // and nothing is ever detected. (The probe that observed the no-op ran at
@@ -19288,15 +19477,13 @@ async function withIndexLock(dir, fn, timings = LOCK_OPTS) {
       // updateKeyring's identity re-check before each commit — which, per its own
       // honesty note, narrows the lost-update window; it does not close it.
       //
-      // RESIDUAL, stated honestly — and the previous version of this comment was
-      // WRONG, so trust the numbers below and not the prose. It claimed reaching a
-      // compromised lock "requires our event loop to freeze past `stale`". It does
-      // not. proper-lockfile's stale-break is `stat` -> judge stale -> `rmdir` ->
+      // RESIDUAL, stated honestly: reaching a compromised lock does NOT require our
+      // event loop to freeze past `stale`. proper-lockfile's stale-break is `stat` -> judge stale -> `rmdir` ->
       // `mkdir`, and it never re-checks that the directory it removes is the one it
       // judged: two waiters can both condemn one crash remnant, and the second's
       // already-decided rmdir destroys the first's FRESH lock. Nothing freezes.
       //
-      // MEASURED against this exact config (probes recorded in the MR):
+      // MEASURED against this exact config (probe results below):
       //     real OS processes, no injection : 0/25 and 1/25 (two independent runs)
       //     in-process, 5 waiters           : ~3% per round
       //     rival's rmdir lagged one turn   : 19/25
@@ -19308,10 +19495,10 @@ async function withIndexLock(dir, fn, timings = LOCK_OPTS) {
       // round-trip. Rare, not impossible — and inherent to mtime-based locking of
       // this shape.
       //
-      // Accepted KNOWINGLY. The hand-rolled lock this replaced serialised the break
-      // behind a second mutex — the right idea — and that mutex then age-broke a LIVE
-      // breaker at 10s with no liveness check: `maxOccupancy = 2`, measured with no
-      // injection at all, plus 0.57% of contended acquires dying on Windows EPERM.
+      // Accepted KNOWINGLY. A hand-rolled lock that serialised the break
+      // behind a second mutex — the right idea — hits a defect there: that mutex age-breaks a LIVE
+      // breaker at 10s with no liveness check (`maxOccupancy = 2`, measured with no
+      // injection at all), plus 0.57% of contended acquires dying on Windows EPERM.
       // Trading a measured, reachable defect for one that needs injected lag to
       // observe is the right trade; pretending it is zero is not. If it ever needs
       // closing the fix is upstream (re-stat under the removal), NOT another
@@ -19441,8 +19628,8 @@ var Keyring = class _Keyring {
   /**
    * Where new secrets go, or undefined if the selected store isn't actually here.
    *
-   * That sounds impossible — the file store is always constructed — and an earlier
-   * version said exactly that and cast the `undefined` away. It was wrong:
+   * That sounds impossible — the file store is always constructed — so it is tempting
+   * to cast the `undefined` away. That would be wrong:
    * `new Keyring({ selection: { kind: 'os-keychain' } })` with no `keychainStore`
    * names a store that was never supplied, and a cast does not conjure one. Return
    * the honest type and let {@link storeSecretSomewhere} handle it, rather than
@@ -19620,7 +19807,7 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
    * {@link storeSecretSomewhere} throws — i.e. only when no store on this machine
    * will accept a write at all, which is the failure worth stopping for.
    *
-   * Still NOT a proof that {@link add} will succeed, and the gap is now only the
+   * Still NOT a proof that {@link add} will succeed, and the remaining gap is only the
    * genuinely transient: a lock another process holds for longer than the retry
    * budget, or a CAS race, either of which a retry actually fixes. What it DOES
    * cover is every deterministic refusal — no writable secret store, and an index
@@ -19654,11 +19841,11 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
    * delete, and no other store PROVED it still holds a copy.
    *
    * That is deliberately WEAKER than "proved gone everywhere", and saying the
-   * stronger thing (an earlier version promised "PROVED gone") hid a real residual:
+   * stronger thing ("PROVED gone") would hide a real residual:
    * a non-home store vetoes only on `present`, and a LOCKED keychain answers
    * `unknown` — so on the one state this store's model is built around, a stale copy behind a
    * locked non-home store passes unvetoed. That is the chosen trade, not an
-   * oversight: the alternative (veto on doubt) shipped, and made an unrelated
+   * oversight: the alternative (veto on doubt) would let an unrelated
    * locked keychain block removal of file-store entries forever, with advice to
    * unlock a store that never held the secret.
    *
@@ -19719,7 +19906,7 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
    * freshly minted `keyId` on every path (`issueOrRotateKey` either creates a new key
    * or revokes-and-recreates, and both mint a new id), so `prior.secretRef !==
    * stamped.secretRef` always holds and `add` always takes the `forgetEverywhere`
-   * branch. Two reviewers read this as dead code. It is not — it is UNEXERCISED, and
+   * branch. That does not make this dead code — it is UNEXERCISED by `join`, and
    * the distinction matters:
    *
    *   - `add` is public and takes the entry as an argument, so "the caller supplies a
@@ -19786,10 +19973,10 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
    * `keyId`, so dropping it while the `ssk_*` survives leaves a live, unrevokable
    * credential on the machine.
    *
-   * The gate is the DELETE'S RESULT, not whether the store looked reachable. An
-   * earlier version gated on reachability and shipped the bug anyway, because a
+   * The gate is the DELETE'S RESULT, not whether the store looked reachable. A
+   * reachability gate would not work, because a
    * LOCKED keychain is perfectly reachable — it constructs, it answers, it just
-   * won't do anything. The guard never fired, the delete quietly failed, the row was
+   * won't do anything. The guard would never fire, the delete would quietly fail, the row would be
    * dropped. Reachability is a proxy; "is it gone?" is the question.
    *
    * The secret is destroyed BEFORE the index row, the opposite of {@link add}, and
@@ -19804,10 +19991,8 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
    * for as long as a user takes to type would time out every other vectros process,
    * including an MCP server trying to start. The lock buys nothing here anyway —
    * `add` writes its secret outside the lock too, so the two secret-writes were
-   * never serialised by it. So: the INITIAL read is unlocked (an earlier version
-   * claimed it was locked; the correction then overshot to "nothing here reads
-   * under a lock" — false too: the commit-time re-check below IS a read inside
-   * `updateKeyring`'s lock). Delete outside the lock, then commit under it,
+   * never serialised by it. So: the INITIAL read is unlocked (the commit-time
+   * re-check below, by contrast, IS a read inside `updateKeyring`'s lock). Delete outside the lock, then commit under it,
    * re-checking that the entry is still the one the unlocked read saw. That locked
    * re-check is what stands in for having read under the lock to begin with.
    */
@@ -19957,18 +20142,17 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
    * already HAS the secret, so every failure here is silent and leaves the machine
    * as it found it, for the next read to retry.
    *
-   * "As it found it" is a promise about BOTH stores, and that is the part an earlier
-   * version got wrong. It said failure "simply leaves the secret where it was" while
-   * three abort paths returned after `setSecret` had already landed a SECOND copy in
+   * "As it found it" is a promise about BOTH stores. Saying failure "simply leaves the
+   * secret where it was" would be false for any abort path that returned after
+   * `setSecret` had already landed a SECOND copy in
    * the target and left it there — a copy of a live `ssk_*` that no index row names,
    * i.e. the exact strand `forgetEverywhere` exists to prevent, produced by the
    * function that migrates.
    *
    * So the target copy is treated as UNCOMMITTED until the migration actually lands,
    * and `finally` clears it on every other route out. That is structural rather than
-   * remembered: two of the three leaking paths already had a hand-written cleanup and
-   * the other two did not, which is precisely the shape of bug that keeps costing this
-   * file a review round. The flag cannot be forgotten on a path added later.
+   * remembered: a hand-written cleanup per abort path is precisely the shape that gets
+   * forgotten on one of them. The flag cannot be forgotten on a path added later.
    *
    * The ordering is the rest of the design, and each step guards a different disaster:
    * write the new copy; read it back (a write that silently didn't land would
@@ -21129,7 +21313,7 @@ async function resolveBridgeCognitoToken(args, prompt, isTty, resolveCognito = r
   }
   if (!isTty) {
     throw new Error(
-      "No bridge token: set VECTROS_BOOTSTRAP_TOKEN, pass --token, or run `vectros login` first (required in non-interactive mode)."
+      `No bridge token: set VECTROS_BOOTSTRAP_TOKEN, pass --token, or run \`${loginCommandFor(args.env)}\` first (required in non-interactive mode).`
     );
   }
   process.stdout.write(
@@ -21238,7 +21422,9 @@ ${renderPlan(blueprint, planSteps)}
 `);
     const declaredIdentities = Object.entries(blueprint.identities ?? {});
     if (declaredIdentities.length > 0) {
-      process.stdout.write("\n  Identities to ensure (tenant-wide, idempotent by external id):\n");
+      process.stdout.write(`
+${IDENTITIES_TO_ENSURE_HEADING}
+`);
       for (const [name, decl] of declaredIdentities) {
         process.stdout.write(`    ~ ${name} (${decl.kind}) \u2014 external id '${decl.externalId}'
 `);
@@ -21469,6 +21655,12 @@ ${codeAddHint}`);
     }
     return finishApply();
   } catch (err) {
+    if (err instanceof SessionExpiredError) {
+      process.stderr.write(`
+  \u2716 ${err.message}
+`);
+      return 2;
+    }
     if (err instanceof LostKeyError) {
       process.stderr.write(`
   \u2716 ${err.message}
@@ -21840,7 +22032,9 @@ ${renderPlan(blueprint, buildPlan(blueprint, { noSeed, noKey: true }), { prune:
     process.stdout.write(applySeedNotice(blueprint, args.seed));
     const declaredIdentities = Object.entries(blueprint.identities ?? {});
     if (declaredIdentities.length > 0) {
-      process.stdout.write("\n  Identities to ensure (tenant-wide, idempotent by external id):\n");
+      process.stdout.write(`
+${IDENTITIES_TO_ENSURE_HEADING}
+`);
       for (const [name, decl] of declaredIdentities) {
         process.stdout.write(`    ~ ${name} (${decl.kind}) \u2014 external id '${decl.externalId}'
 `);
@@ -21973,7 +22167,7 @@ function reportApplyError(err) {
   If this is expected (a re-apply of a blueprint you manage), re-run with --confirm-existing-principal
   (with --yes in a pipeline, where it is standing consent), or confirm at the prompt.
   If you don't recognize this identity, investigate the blueprint's servicePrincipal.externalId first.
-  Only the app-context and the principal lookup had run; no grant or anything else was changed.
+  Only the principal lookup had run; no context, grant or anything else was created or changed.
 `
     );
     return 3;
@@ -22326,10 +22520,14 @@ schemas:
 accessProfile:
   # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference/entities),
   # PLUS profiles:r/u/d (bounded by the platform to redistributing access you already have,
-  # never granting more) and profiles:c:self (create a profile for yourself only \u2014 the
-  # platform resolves "self" from the caller, not from anything you declare here). A bare
-  # profiles:c, or profiles:c:usr_<id> naming another principal, is HARD-REJECTED \u2014 by
-  # design, no override. Same for keys/users/admin/namespaces/*.
+  # never granting more), profiles:c:self (create a profile for yourself only \u2014 the
+  # platform resolves "self" from the caller, not from anything you declare here) and
+  # scripts:x:<script-name> (run one named script that this blueprint ships; there is no bare
+  # or wildcard form).
+  # A bare profiles:c is accepted ONLY when this same clause also declares the
+  # member-lifecycle capability (see "capabilities" below); without it, and always for
+  # profiles:c:usr_<id> naming another principal, it is REJECTED \u2014 no override. Every other
+  # control-plane resource (keys/users/admin/namespaces/triggers/...) and "*" is REJECTED the same way.
   # Ops: c|r|u|d, combinable (records:cru). Prefer the narrowest set (least privilege).
   allowedActions: [records:r, records:c, records:u, search:r, schemas:r]
   # dataScope binds the key to specific owners. Include null to ALSO see
@@ -22345,8 +22543,10 @@ accessProfile:
   # above) unless every owner genuinely sharing every record is what you want.
   dataScope: {}
   # capabilities is a SEPARATE gated dimension from allowedActions \u2014 named platform
-  # effects a resource:ops verb can't express. Only 'member-lifecycle' is admitted
-  # today; every other name is HARD-REJECTED, same posture as the scope gate above.
+  # effects a resource:ops verb can't express. Only 'member-lifecycle' and
+  # 'delegate-principal-stamp' are admitted today; every other name is REJECTED, same
+  # posture as the scope gate above. 'member-lifecycle' is also what lets this clause
+  # carry a bare profiles:c.
   # capabilities: [member-lifecycle]
 
 servicePrincipal:
@@ -22433,8 +22633,10 @@ Usage:
 
 <file|name> is a path to your own blueprint (YAML .yaml/.yml or JSON .json) OR
 the name of a bundled blueprint. The same scope gate that protects bundled
-blueprints applies to file blueprints \u2014 a forked or hand-written blueprint can
-never request control-plane access.
+blueprints applies to file blueprints: beyond data-plane access, a forked or
+hand-written blueprint can request only a short allowlist of narrow exceptions
+(profiles:r/u/d, profiles:c:self, a bare profiles:c beside member-lifecycle,
+scripts:x:<script-name>); every other control-plane scope is rejected.
 
 A blueprint may declare a top-level 'inputs:' block and reference its values
 with \${{ inputs.<name> }} (and the built-ins \${{ vectros.context }} /
@@ -22546,7 +22748,9 @@ ${renderPlan(blueprint, steps)}
 `);
   const declaredIdentities = Object.entries(blueprint.identities ?? {});
   if (declaredIdentities.length > 0) {
-    process.stdout.write("\n  Identities to ensure (tenant-wide, idempotent by external id):\n");
+    process.stdout.write(`
+${IDENTITIES_TO_ENSURE_HEADING}
+`);
     for (const [name, decl] of declaredIdentities) {
       process.stdout.write(`    ~ ${name} (${decl.kind}) \u2014 external id '${decl.externalId}'
 `);
@@ -22680,6 +22884,89 @@ ${BLUEPRINT_HELP}
 // src/program.ts
 var import_commander = require("commander");
 
+// src/dev-api.ts
+var DeveloperApiError = class extends Error {
+  statusCode;
+  /** The platform's error body, when it answered with one (its message, request id and error code). */
+  body;
+  constructor(message, statusCode, body) {
+    super(message);
+    this.name = "DeveloperApiError";
+    this.statusCode = statusCode;
+    this.body = body;
+  }
+};
+async function fetchDeveloperUsersPage(opts) {
+  const { cognitoToken, apiBaseUrl, tenant, startFrom, limit, fetchImpl = fetch } = opts;
+  const base = apiBaseUrl.replace(/\/$/, "");
+  let url = `${base}/developer/users?tenant=${encodeURIComponent(tenant)}`;
+  if (startFrom) url += `&startFrom=${encodeURIComponent(startFrom)}`;
+  if (limit !== void 0) url += `&limit=${encodeURIComponent(String(limit))}`;
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${cognitoToken}` }
+    });
+  } catch (err) {
+    throw new DeveloperApiError(
+      `Request to /developer/users failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    const hint = res.status === 403 ? " (this command requires an account owner login \u2014 sign in as the owner and retry)" : "";
+    throw new DeveloperApiError(
+      `GET /developer/users failed: HTTP ${res.status}${hint}${body ? ` \u2014 ${body}` : ""}`,
+      res.status
+    );
+  }
+  let parsed;
+  try {
+    parsed = await res.json();
+  } catch {
+    throw new DeveloperApiError("GET /developer/users returned a non-JSON body");
+  }
+  const data = Array.isArray(parsed.data) ? parsed.data : [];
+  const nextCursor = typeof parsed.nextCursor === "string" ? parsed.nextCursor : null;
+  return { data, nextCursor };
+}
+async function fetchDeveloperMe(opts) {
+  const { cognitoToken, apiBaseUrl, tenant, fetchImpl = fetch } = opts;
+  const url = `${apiBaseUrl.replace(/\/$/, "")}/developer/me?tenant=${encodeURIComponent(tenant)}`;
+  let res;
+  try {
+    res = await fetchImpl(url, { method: "GET", headers: { Authorization: `Bearer ${cognitoToken}` } });
+  } catch (err) {
+    throw new DeveloperApiError(
+      `Request to /developer/me failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    const failure = await devRouteError(res, "GET /developer/me");
+    throw new DeveloperApiError(
+      `GET /developer/me failed: HTTP ${res.status}`,
+      res.status,
+      failure.body
+    );
+  }
+  let parsed;
+  try {
+    parsed = await res.json();
+  } catch {
+    throw new DeveloperApiError("GET /developer/me returned a non-JSON body");
+  }
+  if (typeof parsed.principalId !== "string" || typeof parsed.userId !== "string") {
+    throw new DeveloperApiError("GET /developer/me returned no principal");
+  }
+  return {
+    principalId: parsed.principalId,
+    userId: parsed.userId,
+    tenantId: typeof parsed.tenantId === "string" ? parsed.tenantId : void 0
+  };
+}
+
 // src/self-principal.ts
 var PRINCIPAL_PREFIX_USER = "usr_";
 function emailFromJwt(token) {
@@ -22708,6 +22995,37 @@ async function resolveSelfPrincipal(client, cognitoToken) {
   if (!match?.id) return null;
   return { principalId: `${PRINCIPAL_PREFIX_USER}${match.id}`, userId: match.id, email };
 }
+async function resolveSelfPrincipalForTenant(auth, fetchImpl) {
+  const tenant = auth.tenant ?? "live";
+  let me;
+  try {
+    me = await fetchDeveloperMe({
+      cognitoToken: auth.cognitoToken,
+      apiBaseUrl: auth.baseUrl,
+      tenant,
+      ...fetchImpl ? { fetchImpl } : {}
+    });
+  } catch (err) {
+    if (err instanceof DeveloperApiError && err.statusCode !== void 0) {
+      if (err.body?.errorCode === "SESSION_REFRESH_REQUIRED") throw new SessionExpiredError(auth.env ?? "production");
+      throw err;
+    }
+    if (tenant === "test") throw err;
+    return resolveSelfPrincipal(auth.client, auth.cognitoToken);
+  }
+  if (me === null) return null;
+  const forThisTenant = Boolean(auth.tenantId && me.tenantId && me.tenantId === auth.tenantId);
+  if (forThisTenant && me.principalId.startsWith(PRINCIPAL_PREFIX_USER)) {
+    return { principalId: me.principalId, userId: me.userId, email: emailFromJwt(auth.cognitoToken) ?? "" };
+  }
+  return tenant === "live" ? resolveSelfPrincipal(auth.client, auth.cognitoToken) : null;
+}
+function selfPrincipalUnresolvedMessage(tenant, flag) {
+  if (tenant === "test") {
+    return `Could not resolve your own user id in the test tenant: the platform did not report one for this login. Find it with \`vectros identity list-all --tenant test\` (an owner login) and pass ${flag} usr_<id> explicitly.`;
+  }
+  return `Could not resolve your own user id from your login. Pass ${flag} usr_<id> explicitly (find the id with \`vectros identity list --type user\`).`;
+}
 
 // src/commands/whoami.ts
 async function runWhoami(options, deps = {}) {
@@ -22715,12 +23033,19 @@ async function runWhoami(options, deps = {}) {
     const { identity, baseUrl } = auth;
     let self2 = null;
     try {
-      self2 = await resolveSelfPrincipal(auth.client, auth.cognitoToken);
+      self2 = await resolveSelfPrincipalForTenant(
+        { ...auth, client: auth.client },
+        deps.fetchImpl
+      );
     } catch {
       self2 = null;
     }
     if (options.json) {
-      const out = self2 ? { ...identity, userId: self2.userId, userPrincipalId: self2.principalId } : identity;
+      const out = {
+        ...identity,
+        tenantType: auth.tenant,
+        ...self2 ? { userId: self2.userId, userPrincipalId: self2.principalId } : {}
+      };
       process.stdout.write(`${formatJson(out)}
 `);
       return 0;
@@ -22729,6 +23054,7 @@ async function runWhoami(options, deps = {}) {
     process.stdout.write(
       "\n" + formatKeyValues([
         ["tenant", identity.tenantId],
+        ["tenant type", auth.tenant],
         ["environment", identity.environment],
         ["principal", identity.principalType],
         ["principal id", identity.principalKeyId],
@@ -23121,51 +23447,6 @@ ${list}
   });
 }
 
-// src/dev-api.ts
-var DeveloperApiError = class extends Error {
-  statusCode;
-  constructor(message, statusCode) {
-    super(message);
-    this.name = "DeveloperApiError";
-    this.statusCode = statusCode;
-  }
-};
-async function fetchDeveloperUsersPage(opts) {
-  const { cognitoToken, apiBaseUrl, tenant, startFrom, limit, fetchImpl = fetch } = opts;
-  const base = apiBaseUrl.replace(/\/$/, "");
-  let url = `${base}/developer/users?tenant=${encodeURIComponent(tenant)}`;
-  if (startFrom) url += `&startFrom=${encodeURIComponent(startFrom)}`;
-  if (limit !== void 0) url += `&limit=${encodeURIComponent(String(limit))}`;
-  let res;
-  try {
-    res = await fetchImpl(url, {
-      method: "GET",
-      headers: { Authorization: `Bearer ${cognitoToken}` }
-    });
-  } catch (err) {
-    throw new DeveloperApiError(
-      `Request to /developer/users failed: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    const hint = res.status === 403 ? " (this command requires an account owner login \u2014 sign in as the owner and retry)" : "";
-    throw new DeveloperApiError(
-      `GET /developer/users failed: HTTP ${res.status}${hint}${body ? ` \u2014 ${body}` : ""}`,
-      res.status
-    );
-  }
-  let parsed;
-  try {
-    parsed = await res.json();
-  } catch {
-    throw new DeveloperApiError("GET /developer/users returned a non-JSON body");
-  }
-  const data = Array.isArray(parsed.data) ? parsed.data : [];
-  const nextCursor = typeof parsed.nextCursor === "string" ? parsed.nextCursor : null;
-  return { data, nextCursor };
-}
-
 // src/commands/identity.ts
 function isUserDimension(type) {
   return type === "user";
@@ -23461,14 +23742,13 @@ function assertPrincipalShape(principal) {
   }
 }
 var SELF_PRINCIPAL_ALIAS = "me";
-async function resolvePrincipalArg(raw, auth) {
+async function resolvePrincipalArg(raw, auth, deps) {
   if (raw !== SELF_PRINCIPAL_ALIAS) return raw;
-  const self2 = await resolveSelfPrincipal(auth.client, auth.cognitoToken);
-  if (!self2) {
-    throw new Error(
-      "Could not resolve your own user id from your login. Pass --principal usr_<id> explicitly (find the id with `vectros identity list --type user`)."
-    );
-  }
+  const self2 = await resolveSelfPrincipalForTenant(
+    { ...auth, client: auth.client },
+    deps.fetchImpl
+  );
+  if (!self2) throw new Error(selfPrincipalUnresolvedMessage(auth.tenant, "--principal"));
   return self2.principalId;
 }
 function roleSummary(p) {
@@ -23521,7 +23801,7 @@ async function runAccessGrant(opts, deps = {}) {
   return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
     try {
-      const principal = await resolvePrincipalArg(opts.principal, auth);
+      const principal = await resolvePrincipalArg(opts.principal, auth, deps);
       const scopes = hasActions ? [{ allowed_actions: splitCsv(opts.actions) }] : void 0;
       const profile = await client.auth.createAccessProfile({
         contextId: opts.context,
@@ -23531,8 +23811,10 @@ async function runAccessGrant(opts, deps = {}) {
           // Always send the plural `roleIds`, even for a single
           // `--role`: it is a strict superset of the deprecated singular
           // `roleId` (equivalent to `roleIds: ["<value>"]`), and the platform
-          // reads it uniformly regardless of how many roles compose.
-          roleIds: opts.role,
+          // reads it uniformly regardless of how many roles compose. With
+          // `--actions` there is no role: omit `roleIds` (the platform refuses an
+          // empty list next to inline `scopes`).
+          roleIds: hasRole ? opts.role : void 0,
           scopes,
           identityOverrides
         }
@@ -23569,7 +23851,7 @@ async function runAccessRevoke(opts, deps = {}) {
   return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
     try {
-      const principal = await resolvePrincipalArg(opts.principal, auth);
+      const principal = await resolvePrincipalArg(opts.principal, auth, deps);
       await client.auth.deleteAccessProfile({ contextId: opts.context, principalId: principal });
       process.stdout.write(`  \u2714 Revoked ${principal} from '${opts.context}'
 `);
@@ -23581,6 +23863,12 @@ async function runAccessRevoke(opts, deps = {}) {
     }
   });
 }
+function searchedContextNotice(principal, rows, tenant) {
+  if (rows.some((r) => r.contextId !== void 0 && r.contextId !== DEFAULT_CONTEXT_ID)) return void 0;
+  const tenantFlag = tenant === "test" ? " --tenant test" : "";
+  return `  \u2139 Listed with a token pinned to context '${DEFAULT_CONTEXT_ID}' (${tenant} tenant). Depending on the caller, the platform may not look beyond that context, so a grant in another context may be missing; an empty result means none in '${DEFAULT_CONTEXT_ID}'. Check a context with: vectros access get --principal ${principal} --context <c>${tenantFlag}
+`;
+}
 async function runAccessList(opts, deps = {}) {
   if (Boolean(opts.context) === Boolean(opts.principal)) {
     process.stderr.write("  \u2716 Provide exactly one of --context <c> or --principal <p>.\n");
@@ -23598,15 +23886,17 @@ async function runAccessList(opts, deps = {}) {
   return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
     try {
-      const principal = opts.principal ? await resolvePrincipalArg(opts.principal, auth) : void 0;
+      const principal = opts.principal ? await resolvePrincipalArg(opts.principal, auth, deps) : void 0;
       const rows = opts.context ? await drainPages(
         (startFrom) => client.auth.listAccessProfiles({ contextId: opts.context, startFrom, limit: PAGE_LIMIT })
       ) : await drainPages(
         (startFrom) => client.auth.listProfilesForPrincipal({ principalId: principal, startFrom, limit: PAGE_LIMIT })
       );
+      const notice = opts.principal ? searchedContextNotice(opts.principal, rows, auth.tenant) : void 0;
       if (opts.json) {
         process.stdout.write(`${formatJson(rows)}
 `);
+        if (notice) process.stderr.write(notice);
         return 0;
       }
       process.stdout.write(
@@ -23617,6 +23907,7 @@ async function runAccessList(opts, deps = {}) {
           { header: "status", get: (r) => r.status }
         ]) + "\n"
       );
+      if (notice) process.stderr.write(notice);
       return 0;
     } catch (err) {
       process.stderr.write(`  \u2716 access list failed: ${formatError(err)}
@@ -23638,7 +23929,7 @@ async function runAccessGet(opts, deps = {}) {
   return withAuth(opts, deps, async (auth) => {
     const client = auth.client;
     try {
-      const principal = await resolvePrincipalArg(opts.principal, auth);
+      const principal = await resolvePrincipalArg(opts.principal, auth, deps);
       const p = await client.auth.getAccessProfile({ contextId: opts.context, principalId: principal });
       if (opts.json) {
         process.stdout.write(`${formatJson(p)}
@@ -23860,11 +24151,13 @@ async function runAccessExplain(opts, deps = {}) {
     try {
       let principal = opts.principal;
       if (principal === SELF_PRINCIPAL_ALIAS2) {
-        const self2 = await resolveSelfPrincipal(auth.client, auth.cognitoToken);
+        const self2 = await resolveSelfPrincipalForTenant(
+          { ...auth, client: auth.client },
+          deps.fetchImpl
+        );
         if (!self2) {
-          process.stderr.write(
-            "  \u2716 Could not resolve your own user id from your login. Pass --principal usr_<id> explicitly.\n"
-          );
+          process.stderr.write(`  \u2716 ${selfPrincipalUnresolvedMessage(auth.tenant, "--principal")}
+`);
           return 1;
         }
         principal = self2.principalId;
@@ -24243,10 +24536,17 @@ async function runContextDestroy(opts, deps = {}) {
 `);
         return 0;
       }
+      const tenantFlag = auth.tenant === "test" ? " --tenant test" : "";
       process.stdout.write(
         `
   \u2714 teardown of '${contextId}' started \u2014 the context and its contents are being
     deleted asynchronously (it reports status 'purging' until the drain completes)
+
+  Not removed: a service principal a blueprint bootstrap created for this context (the
+  externalId in the blueprint's servicePrincipal) belongs to the whole tenant, so it stays. To clean it up
+  when it exists and nothing else uses it:
+    vectros identity list-all${tenantFlag}
+    vectros identity delete --type user --id <id>${tenantFlag}
 `
       );
       return 0;
@@ -24785,7 +25085,7 @@ ${renderIssuer(issuer)}
 var import_node_fs5 = require("fs");
 var readline6 = __toESM(require("readline/promises"));
 var PROVIDER_TYPES = ["ANTHROPIC_NATIVE", "OPENAI_COMPATIBLE"];
-var BILLING_MODES = ["PLATFORM_BILLED", "CUSTOMER_DIRECT"];
+var BILLING_MODES = ["CUSTOMER_DIRECT"];
 var STATUSES = ["ACTIVE", "DISABLED"];
 var MAX_SECRET_BYTES = 8 * 1024;
 async function readBoundedSecret(stream) {
@@ -24864,12 +25164,17 @@ function renderProviderConfig(c) {
     ["defaultProviderModelId", c.defaultProviderModelId],
     ["waiverType", c.waiverType],
     ["billingMode", c.billingMode],
-    ["platformTokenFactor", c.platformTokenFactor],
-    ["platformOutputWeight", c.platformOutputWeight],
     ["status", c.status],
     ["createdAt", c.createdAt]
   ]);
 }
+function billingModeError(value) {
+  if (value === void 0 || BILLING_MODES.includes(value)) return void 0;
+  if (value === "PLATFORM_BILLED") {
+    return "--billing-mode PLATFORM_BILLED is retired: a provider you configure bills you directly, so CUSTOMER_DIRECT is the only billing mode.";
+  }
+  return invalidEnum("--billing-mode", value, BILLING_MODES);
+}
 function invalidEnum(flag, value, allowed) {
   return `${flag} must be one of ${allowed.join(", ")} (got '${value}').`;
 }
@@ -24880,8 +25185,9 @@ async function runProviderConfigCreate(opts, deps = {}) {
 `);
     return 2;
   }
-  if (!BILLING_MODES.includes(opts.billingMode)) {
-    process.stderr.write(`  \u2716 ${invalidEnum("--billing-mode", opts.billingMode, BILLING_MODES)}
+  const billingModeProblem = billingModeError(opts.billingMode);
+  if (billingModeProblem !== void 0) {
+    process.stderr.write(`  \u2716 ${billingModeProblem}
 `);
     return 2;
   }
@@ -24890,19 +25196,6 @@ async function runProviderConfigCreate(opts, deps = {}) {
 `);
     return 2;
   }
-  if (opts.billingMode === "PLATFORM_BILLED") {
-    if (opts.platformTokenFactor === void 0 || opts.platformOutputWeight === void 0) {
-      process.stderr.write(
-        "  \u2716 --platform-token-factor and --platform-output-weight are required when --billing-mode PLATFORM_BILLED.\n"
-      );
-      return 2;
-    }
-  } else if (opts.platformTokenFactor !== void 0 || opts.platformOutputWeight !== void 0) {
-    process.stderr.write(
-      "  \u2716 --platform-token-factor/--platform-output-weight only apply with --billing-mode PLATFORM_BILLED.\n"
-    );
-    return 2;
-  }
   let apiKeySecret;
   try {
     apiKeySecret = await resolveApiKeySecret(opts.apiKeySecretFile, deps, "required");
@@ -24927,9 +25220,7 @@ async function runProviderConfigCreate(opts, deps = {}) {
           defaultProviderModelId: opts.defaultProviderModelId,
           apiKeySecret,
           waiverType: opts.waiverType,
-          billingMode: opts.billingMode,
-          platformTokenFactor: opts.platformTokenFactor,
-          platformOutputWeight: opts.platformOutputWeight,
+          billingMode: opts.billingMode ?? "CUSTOMER_DIRECT",
           status: opts.status
         })
       });
@@ -25010,8 +25301,9 @@ async function runProviderConfigUpdate(opts, deps = {}) {
 `);
     return 2;
   }
-  if (opts.billingMode !== void 0 && !BILLING_MODES.includes(opts.billingMode)) {
-    process.stderr.write(`  \u2716 ${invalidEnum("--billing-mode", opts.billingMode, BILLING_MODES)}
+  const billingModeProblem = billingModeError(opts.billingMode);
+  if (billingModeProblem !== void 0) {
+    process.stderr.write(`  \u2716 ${billingModeProblem}
 `);
     return 2;
   }
@@ -25044,8 +25336,6 @@ async function runProviderConfigUpdate(opts, deps = {}) {
           apiKeySecret,
           waiverType: opts.waiverType,
           billingMode: opts.billingMode,
-          platformTokenFactor: opts.platformTokenFactor,
-          platformOutputWeight: opts.platformOutputWeight,
           status: opts.status
         })
       });
@@ -26622,15 +26912,14 @@ async function runBlueprintTest(fileOrName, opts, deps = {}) {
 
 // src/commands/join.ts
 var SELF_ALIAS = "me";
-async function resolvePrincipal(as, auth) {
+async function resolvePrincipal(as, auth, deps) {
   const raw = as ?? SELF_ALIAS;
   if (raw === SELF_ALIAS) {
-    const self2 = await resolveSelfPrincipal(auth.client, auth.cognitoToken);
-    if (!self2) {
-      throw new Error(
-        "Could not resolve your own user id from your login. Pass --as usr_<id> explicitly (find it with `vectros identity list --type user`)."
-      );
-    }
+    const self2 = await resolveSelfPrincipalForTenant(
+      { ...auth, client: auth.client },
+      deps.fetchImpl
+    );
+    if (!self2) throw new Error(selfPrincipalUnresolvedMessage(auth.tenant, "--as"));
     return self2.principalId;
   }
   if (!raw.startsWith("usr_")) {
@@ -26700,7 +26989,7 @@ async function runJoin(opts, deps = {}) {
     const client = auth.client;
     try {
       const tenantId = requireTenantId(auth);
-      const principalId = await resolvePrincipal(opts.as, auth);
+      const principalId = await resolvePrincipal(opts.as, auth, deps);
       const userId = normalizePrincipalUserId(principalId);
       const scopes = hasActions ? [{ allowed_actions: splitCsv(opts.actions) }] : void 0;
       await client.auth.createAccessProfile({
@@ -26711,7 +27000,9 @@ async function runJoin(opts, deps = {}) {
           // Always send the plural `roleIds`, even for a single
           // `--role`: a strict superset of the deprecated singular `roleId`,
           // read uniformly by the platform regardless of how many compose.
-          roleIds: opts.role,
+          // With `--actions` there is no role: omit `roleIds` (the platform
+          // refuses an empty list next to inline `scopes`).
+          roleIds: hasRole ? opts.role : void 0,
           scopes,
           identityOverrides
         }
@@ -26798,9 +27089,9 @@ function emitJoined(opts) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.24.0" : "dev",
-  sdk: true ? "0.46.0" : "dev",
-  blueprints: true ? "0.20.1" : "dev"
+  cli: true ? "0.26.0" : "dev",
+  sdk: true ? "0.48.0" : "dev",
+  blueprints: true ? "0.20.3" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -26837,18 +27128,6 @@ function parseTenantFlag(raw) {
   }
   return raw;
 }
-var NUMBER_FLAG_INVALID = /* @__PURE__ */ Symbol("parseOptionalNumberFlag:invalid");
-function parseOptionalNumberFlag(flag, raw) {
-  if (raw === void 0) return void 0;
-  const n = Number(raw);
-  if (!Number.isFinite(n)) {
-    process.stderr.write(`  \u2716 ${flag} must be a number (got '${raw}')
-`);
-    process.exitCode = 2;
-    return NUMBER_FLAG_INVALID;
-  }
-  return n;
-}
 function toCommonOptions(flags) {
   return {
     env: flags.env,
@@ -26871,9 +27150,11 @@ function buildProgram(deps = {}) {
   program.command("logout").description("Clear the stored login session.").action(async () => {
     process.exitCode = await runLogout({ env: "production", json: false });
   });
-  const whoami = program.command("whoami").description("Show the authenticated session (tenant, env, principal).");
+  const whoami = program.command("whoami").description("Show the authenticated session (tenant, env, principal).").option("--tenant <tenant>", "tenant to show: 'test' or 'live' (default live)");
   addCommonAuthOptions(whoami).action(async (flags) => {
-    process.exitCode = await runWhoami(toCommonOptions(flags), deps);
+    const tenant = parseTenantFlag(flags.tenant);
+    if (tenant === TENANT_FLAG_INVALID) return;
+    process.exitCode = await runWhoami({ ...toCommonOptions(flags), tenant }, deps);
   });
   const blueprintTest = program.command("blueprint-test").description("Apply a blueprint to a live env, assert it provisioned a working credential, then tear it down.").argument("<file>", "blueprint file path (./my.yaml) or a bundled blueprint name").option("--keep", "leave the provisioned graph in place (skip teardown) for inspection").option("--tenant <tenant>", "target tenant for the run: 'test' or 'live' (default live)");
   addCommonAuthOptions(blueprintTest).action(
@@ -27020,7 +27301,7 @@ function registerContextCommands(program, deps) {
     );
   });
   const destroy = context.command("destroy").description(
-    "Permanently destroy an app context and ALL of its data (irreversible; asks for confirmation)."
+    "Permanently destroy an app context and ALL of its data (irreversible; asks for confirmation). A blueprint's service principal belongs to the whole tenant and is NOT removed: delete it with 'identity delete'."
   ).argument("<contextId>", "the app context to destroy").option("--force", "skip the interactive confirmation (required when stdin is not a TTY)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
   addCommonAuthOptions(destroy).action(
     async (contextId, flags) => {
@@ -27175,15 +27456,11 @@ function registerIssuersCommands(program, deps) {
 }
 function registerProviderConfigCommands(program, deps) {
   const providerConfig = program.command("provider-config").description("Manage BYOM (bring-your-own-model) tenant-level provider configs.");
-  const create = providerConfig.command("create").description("Create a new BYOM provider config (not idempotent \u2014 a repeat --alias 400s).").requiredOption("--alias <alias>", "operator-facing name used to select this config; unique per tenant").requiredOption("--provider-type <type>", "'ANTHROPIC_NATIVE' or 'OPENAI_COMPATIBLE'").option("--endpoint <url>", "required for OPENAI_COMPATIBLE (no default); an optional override for ANTHROPIC_NATIVE").option("--declared-processing-region <region>", "customer-asserted, free-text, Vectros-unverified transparency field").option("--default-provider-model-id <id>", "convenience default only \u2014 a per-request model id, when the caller supplies one, always takes precedence").requiredOption("--api-key-secret-file <path>", "path to a file holding the provider credential ('-' for stdin) \u2014 never pass the secret as a bare flag value").requiredOption("--waiver-type <type>", "the waiver code this config is entitled under (e.g. byo-model-inference:customer-key)").requiredOption("--billing-mode <mode>", "'PLATFORM_BILLED' or 'CUSTOMER_DIRECT'").option("--platform-token-factor <n>", "required when --billing-mode PLATFORM_BILLED; refused otherwise").option("--platform-output-weight <n>", "required when --billing-mode PLATFORM_BILLED; refused otherwise").option("--status <status>", "'ACTIVE' or 'DISABLED' (default ACTIVE) \u2014 ACTIVE requires the tenant already hold a granted waiver for --waiver-type").option("--tenant <tenant>", "tenant to create the config in: 'test' or 'live' (default live)");
+  const create = providerConfig.command("create").description("Create a new BYOM provider config (not idempotent \u2014 a repeat --alias 400s).").requiredOption("--alias <alias>", "operator-facing name used to select this config; unique per tenant; 1-64 lowercase letters, digits, - or _").requiredOption("--provider-type <type>", "'ANTHROPIC_NATIVE' or 'OPENAI_COMPATIBLE'").option("--endpoint <url>", "required for OPENAI_COMPATIBLE (no default); an optional override for ANTHROPIC_NATIVE; https on port 443").option("--declared-processing-region <region>", "customer-asserted, free-text, Vectros-unverified transparency field").option("--default-provider-model-id <id>", "convenience default only \u2014 a per-request model id, when the caller supplies one, always takes precedence").requiredOption("--api-key-secret-file <path>", "path to a file holding the provider credential ('-' for stdin) \u2014 never pass the secret as a bare flag value").requiredOption("--waiver-type <type>", "the waiver code this config is entitled under; the platform accepts byo-model-inference:customer-key for a config you set up yourself").option("--billing-mode <mode>", "only 'CUSTOMER_DIRECT' (your provider bills you), which is also the default; 'PLATFORM_BILLED' is retired").option("--status <status>", "'ACTIVE' or 'DISABLED' (default ACTIVE) \u2014 ACTIVE requires the tenant already hold a granted waiver for --waiver-type").option("--tenant <tenant>", "tenant to create the config in: 'test' or 'live' (default live)");
   addCommonAuthOptions(create).action(
     async (flags) => {
       const tenant = parseTenantFlag(flags.tenant);
       if (tenant === TENANT_FLAG_INVALID) return;
-      const platformTokenFactor = parseOptionalNumberFlag("--platform-token-factor", flags.platformTokenFactor);
-      if (platformTokenFactor === NUMBER_FLAG_INVALID) return;
-      const platformOutputWeight = parseOptionalNumberFlag("--platform-output-weight", flags.platformOutputWeight);
-      if (platformOutputWeight === NUMBER_FLAG_INVALID) return;
       process.exitCode = await runProviderConfigCreate(
         {
           ...toCommonOptions(flags),
@@ -27195,8 +27472,6 @@ function registerProviderConfigCommands(program, deps) {
           apiKeySecretFile: flags.apiKeySecretFile,
           waiverType: flags.waiverType,
           billingMode: flags.billingMode,
-          platformTokenFactor,
-          platformOutputWeight,
           status: flags.status,
           tenant
         },
@@ -27214,13 +27489,9 @@ function registerProviderConfigCommands(program, deps) {
   addCommonAuthOptions(get).action(async (id, flags) => {
     process.exitCode = await runProviderConfigGet({ ...toCommonOptions(flags), id }, deps);
   });
-  const update = providerConfig.command("update").description("Patch a provider config (partial update \u2014 an omitted field is left unchanged).").argument("<id>").option("--alias <alias>", "rename this config (still unique per tenant)").option("--provider-type <type>", "'ANTHROPIC_NATIVE' or 'OPENAI_COMPATIBLE'").option("--endpoint <url>", "update the provider endpoint").option("--declared-processing-region <region>", "update the transparency field").option("--default-provider-model-id <id>", "update the convenience default model id").option("--api-key-secret-file <path>", "rotate the provider credential from a file ('-' for stdin); omit to leave the stored secret unchanged").option("--waiver-type <type>", "update the waiver code this config is entitled under").option("--billing-mode <mode>", "'PLATFORM_BILLED' or 'CUSTOMER_DIRECT' \u2014 switching to CUSTOMER_DIRECT clears the platform pricing fields server-side").option("--platform-token-factor <n>", "update the platform pricing factor (PLATFORM_BILLED only)").option("--platform-output-weight <n>", "update the platform pricing weight (PLATFORM_BILLED only)").option("--status <status>", "'ACTIVE' or 'DISABLED' \u2014 activating requires a granted waiver for this config's waiverType");
+  const update = providerConfig.command("update").description("Patch a provider config (partial update \u2014 an omitted field is left unchanged).").argument("<id>").option("--alias <alias>", "rename this config (unique per tenant); the platform refuses a new alias that is not 1-64 lowercase letters, digits, - or _ (an alias the config already holds is accepted)").option("--provider-type <type>", "'ANTHROPIC_NATIVE' or 'OPENAI_COMPATIBLE'; changing the type of an existing config needs --endpoint stated in the same command (--endpoint '' means the provider's default), or the platform answers 400").option("--endpoint <url>", "update the provider endpoint; https on port 443; changing the host needs --api-key-secret-file again; '' clears it (the provider's default), which also changes the host").option("--declared-processing-region <region>", "update the transparency field").option("--default-provider-model-id <id>", "update the convenience default model id").option("--api-key-secret-file <path>", "rotate the provider credential from a file ('-' for stdin); omit to leave the stored secret unchanged (required when --endpoint changes the host)").option("--waiver-type <type>", "update the waiver code this config is entitled under; the platform refuses a change to anything but byo-model-inference:customer-key (a value the config already holds is accepted)").option("--billing-mode <mode>", "only 'CUSTOMER_DIRECT' (your provider bills you); 'PLATFORM_BILLED' is retired. Omit it to leave the stored mode unchanged").option("--status <status>", "'ACTIVE' or 'DISABLED' \u2014 activating requires a granted waiver for this config's waiverType");
   addCommonAuthOptions(update).action(
     async (id, flags) => {
-      const platformTokenFactor = parseOptionalNumberFlag("--platform-token-factor", flags.platformTokenFactor);
-      if (platformTokenFactor === NUMBER_FLAG_INVALID) return;
-      const platformOutputWeight = parseOptionalNumberFlag("--platform-output-weight", flags.platformOutputWeight);
-      if (platformOutputWeight === NUMBER_FLAG_INVALID) return;
       process.exitCode = await runProviderConfigUpdate(
         {
           ...toCommonOptions(flags),
@@ -27233,8 +27504,6 @@ function registerProviderConfigCommands(program, deps) {
           apiKeySecretFile: flags.apiKeySecretFile,
           waiverType: flags.waiverType,
           billingMode: flags.billingMode,
-          platformTokenFactor,
-          platformOutputWeight,
           status: flags.status
         },
         deps
@@ -27502,12 +27771,15 @@ function dimensionOption() {
   ).makeOptionMandatory();
 }
 function registerIdentityCommands(program, deps) {
-  const identity = program.command("identity").description("Manage tenant-wide principals (users + namespaced entities) \u2014 reference, never embed.");
-  const create = identity.command("create").description("Create (idempotent by externalId) a principal.").addOption(dimensionOption()).requiredOption("--external-id <id>", "your stable id for the principal (idempotency key)").option("--name <name>", "display name (entity namespaces only, not --type user)").option("--email <email>", "email (user only)").option("--service", "user only: mint a SERVICE principal (default HUMAN)").option("--scope <ns:value>", "entity only: a parent ownership edge (repeatable, \u22642, e.g. org:<id>)", collect, []).option("--metadata <json>", "JSON object of metadata");
+  const identity = program.command("identity").description("Manage principals: users (tenant-wide) and namespaced entities (an entity lives with its namespace) \u2014 reference, never embed.");
+  const create = identity.command("create").description("Create (idempotent by externalId) a principal.").addOption(dimensionOption()).requiredOption("--external-id <id>", "your stable id for the principal (idempotency key)").option("--name <name>", "display name (entity namespaces only, not --type user)").option("--email <email>", "email (user only)").option("--service", "user only: mint a SERVICE principal (default HUMAN)").option("--scope <ns:value>", "entity only: a parent ownership edge (repeatable, \u22642, e.g. org:<id>)", collect, []).option("--metadata <json>", "JSON object of metadata").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(create).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runIdentityCreate({
         ...toCommonOptions(flags),
+        tenant,
         type: flags.type,
         externalId: flags.externalId,
         name: flags.name,
@@ -27518,11 +27790,14 @@ function registerIdentityCommands(program, deps) {
       }, deps);
     }
   );
-  const list = identity.command("list").description("List principals of a dimension (optionally filtered).").addOption(dimensionOption()).option("--external-id <id>", "filter to a stable id").option("--limit <n>", "page size (1\u2013100)", (v) => Number.parseInt(v, 10));
+  const list = identity.command("list").description("List principals of a dimension (optionally filtered).").addOption(dimensionOption()).option("--external-id <id>", "filter to a stable id").option("--limit <n>", "page size (1\u2013100)", (v) => Number.parseInt(v, 10)).option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runIdentityList({
         ...toCommonOptions(flags),
+        tenant,
         type: flags.type,
         externalId: flags.externalId,
         limit: flags.limit
@@ -27542,20 +27817,30 @@ function registerIdentityCommands(program, deps) {
       );
     }
   );
-  const get = identity.command("get").description("Show one principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id (from create/list)");
+  const get = identity.command("get").description("Show one principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id (from create/list)").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(async (flags) => {
-    process.exitCode = await runIdentityGet({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps);
+    const tenant = parseTenantFlag(flags.tenant);
+    if (tenant === TENANT_FLAG_INVALID) return;
+    process.exitCode = await runIdentityGet({ ...toCommonOptions(flags), tenant, type: flags.type, id: flags.id }, deps);
   });
-  const del = identity.command("delete").description("Delete a principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id");
+  const del = identity.command("delete").description("Delete a principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addAuthOptions(del).action(async (flags) => {
-    process.exitCode = await runIdentityDelete({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps);
+    const tenant = parseTenantFlag(flags.tenant);
+    if (tenant === TENANT_FLAG_INVALID) return;
+    process.exitCode = await runIdentityDelete(
+      { ...toCommonOptions(flags), tenant, type: flags.type, id: flags.id },
+      deps
+    );
   });
-  const invite = identity.command("invite").description("Onboard a person into a context by email (POST /v1/users/invite) \u2014 no root key required.").requiredOption("--context <contextId>", "the app context the invitee will operate in").requiredOption("--role <roleId>", "an existing Role in that context; the invitee inherits its scopes").requiredOption("--email <email>", "the invitee's email address").option("--first-name <name>", "personalizes the invitation email greeting").option("--accept-url <url>", "your accept-invite landing page (required unless --no-send-email)").option("--no-send-email", "skip platform delivery; the response carries the raw inviteToken/acceptLink instead");
+  const invite = identity.command("invite").description("Onboard a person into a context by email (POST /v1/users/invite) \u2014 no root key required.").requiredOption("--context <contextId>", "the app context the invitee will operate in").requiredOption("--role <roleId>", "an existing Role in that context; the invitee inherits its scopes").requiredOption("--email <email>", "the invitee's email address").option("--first-name <name>", "personalizes the invitation email greeting").option("--accept-url <url>", "your accept-invite landing page (required unless --no-send-email)").option("--no-send-email", "skip platform delivery; the response carries the raw inviteToken/acceptLink instead").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(invite).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runIdentityInvite(
         {
           ...toCommonOptions(flags),
+          tenant,
           context: flags.context,
           role: flags.role,
           email: flags.email,