@vectros-ai/mcp-server 0.14.0 → 0.16.0

package/dist/cli-http.mjs

@@ -2492,7 +2492,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/admin/keys/scoped");
   }
   /**
-   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. A root API key (`sk_`) is exempt from both bounds.
+   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. Minting a key bound to your OWN principal needs nothing further; minting one bound to a DIFFERENT principal additionally requires the `delegate-mint` capability (`granted_capabilities`) on your credential — without it the request is refused. A root API key (`sk_`) is exempt from all three bounds.
    *
    * @param {Vectros.CreateScopedKeyRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -2824,7 +2824,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope, and applies the same `identityOverrides` bounds the update endpoint documents — a scoped credential may not repoint or clear an identity value it does not itself hold). You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
+   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope, and applies the same `identityOverrides` bounds the update endpoint documents — a scoped credential may not repoint or clear an identity value it does not itself hold). The `principalId` must name a principal that already exists: a `usr_` principal must be a live user in your tenant, so create the user before granting it a profile. A `usr_` id that names no such user is rejected, and no profile is created. `key_` principals are not checked this way. You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
    *
    * @param {Vectros.CreateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -3925,7 +3925,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access.
+   * Returns full usage detail for the requested calendar month, broken down by category (search, documents, and records) with per-category credit estimates and a split between your live and test environments. Defaults to the current month when `year` and `month` are omitted. Requires the `billing:r` scope on scoped tokens; API keys always have access. **A token confined to a single app context sees only that context's usage**: totals, the environment split, and the `contexts` breakdown narrow to it, and the environment your context is not bound to is omitted (`null`), not zeroed. Only a token with cross-context reach sees your full account-wide totals. Two exceptions to the narrowing, since they have no per-context breakdown to narrow to: `reads.calls.used`/`reads.dataOut.bytes` (metered per account, not per context) read as `0` for a confined token rather than a narrowed figure — the corresponding overage-credit charge fields narrow correctly; and `credits.limit` stays your whole plan's ceiling, so `credits.remaining` may overstate the account's true remaining room.
    *
    * @param {Vectros.GetUsageRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -3988,7 +3988,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/usage");
   }
   /**
-   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability.
+   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key sees every context. An ordinary bootstrap credential that didn't specify a context resolves to the `default` app context specifically, not every context — so this call returns 404 for an issuer registered under any other context unless you re-minted the bootstrap token pinned to that context.
    *
    * @param {Vectros.GetIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4046,13 +4046,81 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. Unconditional — unlike some other registry deletes on this API, this does not check for or block on any downstream reference. Any user account already created via this issuer (by a prior self-signup or accepted invite) is NOT deleted or modified, but that user can no longer obtain a NEW token this way once you deregister the issuer — every `POST /v1/auth/token/exchange` call against it will 404, with no distinction between an unknown issuer and one you just deregistered. Register a replacement issuer, or restore this one, before your users' current tokens expire if you want their access to continue uninterrupted.
+   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `status` (`active`/`suspended` — a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
+   *
+   * @param {Vectros.IssuerUpdateRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.updateIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  updateIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateIssuer(request, requestOptions));
+  }
+  async __updateIssuer(request, requestOptions) {
+    const { issuerId, ..._body } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "PUT",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: _body,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/auth/issuers/{issuerId}");
+  }
+  /**
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. Deactivate the affected users first if you intend to cut off their access, or register a replacement issuer before removing this one. An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
    *
    * @param {Vectros.DeleteIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -4094,6 +4162,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -4112,7 +4182,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. Returns a `{data, nextCursor}` envelope.
+   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context sees only the issuers registered in that context; a root API key sees every context. An ordinary bootstrap credential that didn't specify a context resolves to the `default` app context specifically, not every context — so this call returns an empty page for a tenant whose issuers are all registered under a different context unless you re-minted the bootstrap token pinned to that context. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListIssuersRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4169,7 +4239,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
   }
   /**
-   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant.
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`.
    *
    * @param {Vectros.IssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4280,7 +4350,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/ping");
   }
   /**
-   * Returns the access profiles for the given principal across all of your contexts. Use this to answer questions like "which apps does this user have access to?" — for example, to build a member-access summary. Results are confined to your account. Requires the `profiles:r` scope.
+   * Returns the access profiles for the given principal. Looking up your OWN principal — or holding the `context-directory-read` capability — returns the profiles across ALL of your contexts, letting you answer questions like "which apps does this user have access to?". A context-bound credential looking up a DIFFERENT principal instead sees only that principal's profile in your credential's own context (at most one result), never across contexts it has no authority over. Results are always confined to your account. Requires the `profiles:r` scope.
    *
    * @param {Vectros.ListProfilesForPrincipalRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4354,6 +4424,7 @@ var AuthClient = class {
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -4407,6 +4478,8 @@ var AuthClient = class {
           throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -4559,7 +4632,84 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/invite/resend");
   }
   /**
-   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
+   * Re-mints the presented `st_*` scoped token with one or more `identity.<namespace>` values changed — for a caller whose ROLE explicitly grants assuming those values (an invited hr-admin, a multi-org case-handler) and needs to change which value new writes place records under. The request body names one or more namespaces in canonical `scope:<namespace>` form, e.g. `{"scope:org": "orgB"}` — each value must be a plain literal, never a `${{ ... }}` placeholder. When you name MORE THAN ONE namespace, a single one of your roles must grant all of them together: the combination is never assembled from two different roles, because no role author would have vouched for it. `st_*`-only — a root API key or `ssk_*` scoped API key gets 403; neither needs this (root already has full authority, and an `ssk_*`'s identity shape is not what this resolves against).
+   *
+   * **Only an original token may assume.** A token produced BY this endpoint cannot assume again (403) — every assume starts from the token you exchanged for, so the identity you end up with is always one a single role explicitly granted rather than a combination reached by chaining calls. Keep your original token if you need to switch more than once, or exchange for a new one.
+   *
+   * **Entitlement is checked LIVE, against your roles as they are right now** — not against a copy frozen into your token when it was minted. The requested value must be explicitly granted by a role's `assumable` field for that namespace: a POINT check against the one value requested, and a deliberately separate, explicitly-authored question from what the role's `data_scope` permits reading or writing. Holding broad `data_scope` reach in a namespace does NOT by itself grant assuming any value in it.
+   *
+   * **What is preserved, and what is not.** Every clause of your token that does not reference a requested namespace is preserved verbatim, as are all other claims (`partner_user_id`, `context_id`, mint attribution). Clauses that DO reference a requested namespace are kept only if they come from a role that authorized the new value. A role that does not authorize it loses all of its clauses touching that namespace — including any scoped to the value you already held. Assume into a value one role grants and you keep that role's reach, not the reach of roles that never vouched for it.
+   *
+   * The re-minted token's `exp` is IDENTICAL to the presented token's — this call can never extend a session's life. A fresh, independently-revocable `jti` is stamped on every call, and (except when the presented token predates jti support and has none to chain from) the token also carries a `root_jti` revocation-lineage claim so revoking the token you started from closes every value ever assumed from it. Uses the ordinary Vectros `{"message":...}` error shape, not the OAuth envelope `POST /v1/auth/token/exchange` uses — this endpoint's caller is always Vectros-SDK code already holding a bearer token, never generic OAuth tooling.
+   *
+   * @param {Record<string, unknown>} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.UnauthorizedError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.ConflictError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.assumeToken({
+   *         "scope:org": "orgB"
+   *     })
+   */
+  assumeToken(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__assumeToken(request, requestOptions));
+  }
+  async __assumeToken(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/token/assume"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 401:
+          throw new UnauthorizedError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token/assume");
+  }
+  /**
+   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. If your issuer is registered against more than one app context (each via its own audience), `context_id` selects which one to target; omit it when your token's `aud` claim matches only one registered context — the common case, unaffected by this field. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
    *
    * @param {Vectros.TokenExchangeRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4635,9 +4785,9 @@ var ComplianceClient = class {
    * @param {Vectros.ErasureRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.TooManyRequestsError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.compliance.createErasureRequest({
@@ -4676,12 +4826,12 @@ var ComplianceClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -4700,7 +4850,6 @@ var ComplianceClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.compliance.getErasureRequest({
@@ -4741,8 +4890,6 @@ var ComplianceClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -6101,6 +6248,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.listEntities({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         startFrom: "b3BhcXVlLWN1cnNvci1mcm9tLXRoZS1wcmV2aW91cy1wYWdl"
    *     })
    */
@@ -6110,6 +6258,7 @@ var IdentityClient = class {
   async __listEntities(request, requestOptions) {
     const {
       namespace,
+      contextId,
       userId,
       externalId,
       scope,
@@ -6124,6 +6273,7 @@ var IdentityClient = class {
       limit
     } = request;
     const _queryParams = {
+      contextId,
       userId,
       externalId,
       scope,
@@ -6182,6 +6332,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.createEntity({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         body: {
    *             externalId: "team_eng_platform"
    *         }
@@ -6191,9 +6342,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__createEntity(request, requestOptions));
   }
   async __createEntity(request, requestOptions) {
-    const { namespace, upsert, body: _body } = request;
+    const { namespace, upsert, contextId, body: _body } = request;
     const _queryParams = {
-      upsert
+      upsert,
+      contextId
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -6250,14 +6402,18 @@ var IdentityClient = class {
    * @example
    *     await client.identity.getEntity({
    *         namespace: "team",
-   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
+   *         contextId: "myapp"
    *     })
    */
   getEntity(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__getEntity(request, requestOptions));
   }
   async __getEntity(request, requestOptions) {
-    const { namespace, id } = request;
+    const { namespace, id, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6271,7 +6427,7 @@ var IdentityClient = class {
       ),
       method: "GET",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6308,6 +6464,7 @@ var IdentityClient = class {
    *     await client.identity.updateEntity({
    *         namespace: "team",
    *         id: "id",
+   *         contextId: "myapp",
    *         body: {
    *             externalId: "team_eng_platform"
    *         }
@@ -6317,7 +6474,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__updateEntity(request, requestOptions));
   }
   async __updateEntity(request, requestOptions) {
-    const { namespace, id, body: _body } = request;
+    const { namespace, id, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6332,7 +6492,7 @@ var IdentityClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -6372,14 +6532,18 @@ var IdentityClient = class {
    * @example
    *     await client.identity.deleteEntity({
    *         namespace: "team",
-   *         id: "id"
+   *         id: "id",
+   *         contextId: "myapp"
    *     })
    */
   deleteEntity(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__deleteEntity(request, requestOptions));
   }
   async __deleteEntity(request, requestOptions) {
-    const { namespace, id } = request;
+    const { namespace, id, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6393,7 +6557,7 @@ var IdentityClient = class {
       ),
       method: "DELETE",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6436,6 +6600,7 @@ var IdentityClient = class {
    * @example
    *     await client.identity.lookupEntities({
    *         namespace: "team",
+   *         contextId: "myapp",
    *         body: {
    *             type: "person_v1",
    *             field: "ssn"
@@ -6446,7 +6611,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__lookupEntities(request, requestOptions));
   }
   async __lookupEntities(request, requestOptions) {
-    const { namespace, body: _body } = request;
+    const { namespace, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6461,7 +6629,7 @@ var IdentityClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -6505,15 +6673,17 @@ var IdentityClient = class {
    * @example
    *     await client.identity.getEntityVersions({
    *         namespace: "team",
-   *         id: "id"
+   *         id: "id",
+   *         contextId: "myapp"
    *     })
    */
   getEntityVersions(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__getEntityVersions(request, requestOptions));
   }
   async __getEntityVersions(request, requestOptions) {
-    const { namespace, id, startFrom } = request;
+    const { namespace, id, contextId, startFrom } = request;
     const _queryParams = {
+      contextId,
       startFrom
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
@@ -6559,7 +6729,7 @@ var IdentityClient = class {
     );
   }
   /**
-   * Retrieves a single scope-namespace registration by name. The reserved built-ins `org` and `client` are always resolvable.
+   * Retrieves a single scope-namespace registration by name.
    *
    * @param {Vectros.GetNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6575,7 +6745,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__getNamespace(request, requestOptions));
   }
   async __getNamespace(request, requestOptions) {
-    const { namespace } = request;
+    const { namespace, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6589,7 +6762,7 @@ var IdentityClient = class {
       ),
       method: "GET",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6614,7 +6787,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces/{namespace}");
   }
   /**
-   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`, `specificityRank`) of a registered namespace. The namespace name itself is immutable. Requires a root API key. The reserved built-ins cannot be updated.
+   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`, `specificityRank`) of a registered namespace. The namespace name and its `contextId` (which row is selected) are both immutable. Requires a root API key. `org` and `client` are updatable like any other namespace — there is no reserved-built-in exception.
    *
    * @param {Vectros.UpdateNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6636,7 +6809,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__updateNamespace(request, requestOptions));
   }
   async __updateNamespace(request, requestOptions) {
-    const { namespace, body: _body } = request;
+    const { namespace, contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6651,7 +6827,7 @@ var IdentityClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -6682,7 +6858,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/namespaces/{namespace}");
   }
   /**
-   * Deletes a registered scope namespace. Requires a root API key. The reserved built-ins cannot be deleted. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
+   * Deletes a registered scope namespace. Requires a root API key. `org` and `client` are deletable like any other namespace — there is no reserved-built-in exception. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
    *
    * @param {Vectros.DeleteNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6700,7 +6876,10 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__deleteNamespace(request, requestOptions));
   }
   async __deleteNamespace(request, requestOptions) {
-    const { namespace } = request;
+    const { namespace, contextId } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6714,7 +6893,7 @@ var IdentityClient = class {
       ),
       method: "DELETE",
       headers: _headers,
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6743,7 +6922,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/namespaces/{namespace}");
   }
   /**
-   * Returns the scope namespaces registered in your account, with the reserved built-ins `org` and `client` listed first. Returns a `{data, nextCursor}` envelope.
+   * Returns the scope namespaces registered in your account. Returns a `{data, nextCursor}` envelope.
    *
    * @param {Vectros.ListNamespacesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6755,10 +6934,11 @@ var IdentityClient = class {
     return HttpResponsePromise.fromPromise(this.__listNamespaces(request, requestOptions));
   }
   async __listNamespaces(request = {}, requestOptions) {
-    const { startFrom, limit } = request;
+    const { startFrom, limit, contextId } = request;
     const _queryParams = {
       startFrom,
-      limit
+      limit,
+      contextId
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -6793,9 +6973,9 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces");
   }
   /**
-   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key. The reserved names `org` and `client` are built in and cannot be registered.
+   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Also requires `specificityRank`, an explicit, account-unique position in the specificity order used to break recordType schema-resolution ties. Requires a root API key or one of the CLI bootstrap's two provisioning capabilities — never an ordinary partner-grantable scope. A bootstrap credential's registration is confined to its own app context UNLESS it additionally holds the tenant-wide namespace-provisioning capability and `contextId` is omitted, in which case it may register a TENANT-WIDE namespace (visible to every context). `org` and `client` are reserved names, registered the same way as any other namespace.
    *
-   * @param {Vectros.NamespaceRequest} request
+   * @param {Vectros.RegisterNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
@@ -6804,14 +6984,20 @@ var IdentityClient = class {
    *
    * @example
    *     await client.identity.registerNamespace({
-   *         namespace: "team",
-   *         specificityRank: 1500
+   *         body: {
+   *             namespace: "team",
+   *             specificityRank: 1500
+   *         }
    *     })
    */
   registerNamespace(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__registerNamespace(request, requestOptions));
   }
   async __registerNamespace(request, requestOptions) {
+    const { contextId, body: _body } = request;
+    const _queryParams = {
+      contextId
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6826,9 +7012,9 @@ var IdentityClient = class {
       method: "POST",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
-      body: request,
+      body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6857,7 +7043,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/namespaces");
   }
   /**
-   * Returns a paginated list of the users in your account. Pass `externalId` to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply `type` and `field` together with one lookup mode: `value` (exact match), `from`+`to` (range), or `prefix`. Requires the `users:r` scope.
+   * Returns a paginated list of the users in your account. Pass `externalId` to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply `type` and `field` together with one lookup mode: `value` (exact match), `from`+`to` (range), or `prefix`. Requires the `users:r` scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.
    *
    * @param {Vectros.ListUsersRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6922,7 +7108,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users");
   }
   /**
-   * Creates a user identity in your account. The operation is idempotent on `externalId`: if a user with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set `?upsert=true` (this also requires the `users:u` scope). Requires the `users:c` scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the `users:r` scope — a credential holding `users:c` alone receives a `400` ("already exists") on collision instead of the user.
+   * Creates a user identity in your account. The operation is idempotent on `externalId`: if a user with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing user was returned) tells the two apart. To overwrite an existing user's mutable fields (email, status, payload, schema binding) instead of returning it unchanged, set `?upsert=true` (this also requires the `users:u` scope). Requires the `users:c` scope to create. Being returned the existing user on a collision is a read of that user's data and additionally requires the `users:r` scope — a credential holding `users:c` alone receives a `400` ("already exists") on collision instead of the user. A context-confined credential additionally receives the collision echo (or, with `?upsert=true`, is allowed to overwrite) only when the colliding user holds an access profile in the credential's own app context — a cross-context collision otherwise gets the same uniform `400` instead of the other context's user data. One narrow exception on the plain (non-upsert) echo only: the CLI's no-code bootstrap credential can be echoed a colliding user across app contexts, needed for a blueprint to idempotently re-apply against a service principal it provisioned in a non-default context; this does not extend to `?upsert=true`.
    *
    * @param {Vectros.CreateUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7046,7 +7232,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/{id}");
   }
   /**
-   * Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The `type` field is immutable after creation, and `email` cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries `inviteToken`, `externalSubject`, and `emailVerifiedAttestation=true` completes the invitation. Requires the `users:u` scope.
+   * Updates mutable fields on an existing user (such as email, status, payload, or schema binding). The `type` field is immutable after creation, and `email` cannot be changed while an invitation to that user is still outstanding — revoke the invitation, or invite the new address instead. This endpoint also activates an invited user: a PUT that moves a PENDING user to ACTIVE and carries `inviteToken`, `externalSubject`, and `emailVerifiedAttestation=true` completes the invitation. **`externalSubject` set this way is NOT an authentication binding and does not enable sign-in anywhere** — not the Vectros DevPortal/Admin App/web apps, and not `/v1/auth/token/exchange` either; both are granted only by the invitee authenticating themselves. If the invitee needs dev-portal/web-app access, send them the invitation link and let them accept it directly. If the invitee needs to sign in via token exchange, have them redeem `inviteToken` themselves at `/v1/auth/token/exchange` with their own credential — Vectros verifies it there and computes its own value for this field from the verified credential. The value you send here is stored exactly as-is, with no normalization, and does NOT automatically match or deduplicate against what a later token-exchange sign-in computes for the same real-world identity. Call this endpoint directly only if you run your own backend and want Vectros to record which of your own users a given account corresponds to — treat this field as informational for that purpose, not as a way to pre-authorize sign-in. Requires the `users:u` scope.
    *
    * @param {Vectros.UpdateUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7113,12 +7299,13 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/users/{id}");
   }
   /**
-   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope.
+   * Permanently deletes a user identity. This cannot be undone. If the user is a pending invitation, the associated access profile created for that invitation is also removed. Requires the `users:d` scope. Deleting your account's last OWNER is refused (409) — an account must always retain at least one owner. Called by a context-confined credential, deletion is also refused (409) when the user holds access in an app context other than the caller's own — remove the user from the caller's own context first, or use a credential with cross-context reach.
    *
    * @param {Vectros.DeleteUserRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -7158,6 +7345,8 @@ var IdentityClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -7171,7 +7360,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/users/{id}");
   }
   /**
-   * Looks up users by a schema lookup field, with the query criteria carried in the request body rather than the URL. Use this when looking up by a sensitive (blind-indexed) field: the value is blind-indexed server-side and never appears in the URL, request logs, or proxies. The query semantics are identical to the GET /v1/users lookup, which rejects sensitive-field values and directs you here. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
+   * Looks up users by a schema lookup field, with the query criteria carried in the request body rather than the URL. Use this when looking up by a sensitive (blind-indexed) field: the value is blind-indexed server-side and never appears in the URL, request logs, or proxies. The query semantics are identical to the GET /v1/users lookup, which rejects sensitive-field values and directs you here. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope. A context-confined credential only sees users who hold an access profile in the credential's own app context — others are silently absent from the page, not an error.
    *
    * @param {Vectros.IdentityLookupRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7614,14 +7803,14 @@ var RecordsClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Reserved endpoint for fetching multiple records by ID in one call. When available, the response will contain only the records you can see; any IDs that do not exist or are outside your scope are silently omitted (there is no per-ID existence signal), matching the not-found behavior of the single-record GET. It currently returns 501 (not implemented). The documented 200 response schema is the stable shape this endpoint will use once available. Requires the `records:r` scope.
+   * Fetches multiple records by ID in one call (`ids`, maximum 100). The response contains only the records you can access — any id that does not exist, belongs to another account/AppContext, or is outside your token's scope is silently omitted, with no per-id existence signal, matching the not-found behavior of the single-record GET. Payloads are hydrated the same way a by-id GET hydrates them (payloads externalized to object storage are rehydrated for this response). Requires the `records:r` scope (and, for a scoped token, `records:r:<type>` per record type).
    *
    * @param {Vectros.BatchGetRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.TooManyRequestsError}
-   * @throws {@link Vectros.NotImplementedError}
    *
    * @example
    *     await client.records.batchGetRecords()
@@ -7658,12 +7847,12 @@ var RecordsClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        case 501:
-          throw new NotImplementedError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -8477,7 +8666,7 @@ var SchemasClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `scope` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by an identity surface (`user` or `entity`) lists your account-wide identity schemas regardless of the calling context; filtering by record or document lists within the calling context. Requires the `schemas:r` scope.
+   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `scope` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by `surface=user` lists your account-wide identity schemas regardless of the calling context (a `user`-surfaced schema always has one tenant-wide home). Filtering by `surface=entity` reads your own app context's entity schemas AND the tenant-wide home together, newest first, through a single cursor — an entity schema may live in either home depending on where its namespace is placed (see `POST /v1/namespaces`). Filtering by `record` or `document` lists within the calling context only. Requires the `schemas:r` scope.
    *
    * @param {Vectros.ListSchemasRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8765,6 +8954,7 @@ var SchemasClient = class {
    * @param {Vectros.DeleteSchemaRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
@@ -8804,6 +8994,8 @@ var SchemasClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 409:
@@ -9018,7 +9210,7 @@ import {
   ListToolsRequestSchema,
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 
 // src/auth.ts
 var KEY_RE = /^(sk|ssk|st)_(live|test)_/;
@@ -9062,8 +9254,8 @@ function warnOnSuboptimalKey(key, log) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  mcpServer: true ? "0.14.0" : "dev",
-  sdk: true ? "0.39.0" : "dev"
+  mcpServer: true ? "0.16.0" : "dev",
+  sdk: true ? "0.41.0" : "dev"
 };
 
 // src/log.ts
@@ -9371,7 +9563,7 @@ var inputSchema = {
   // Ownership.
   userId: z.string().optional().describe("Restrict to content owned by this user (Vectros UUID)."),
   scope: z.string().optional().describe(
-    'Restrict to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+    'Restrict to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are reserved namespace names, registered like any other; others are namespaces you registered yourself.'
   ),
   // Date window.
   createdAfter: z.string().optional().describe("Restrict to content created at/after this ISO 8601 UTC timestamp."),
@@ -9511,7 +9703,7 @@ var inputSchema2 = {
   // List-mode args:
   userId: z2.string().optional().describe("List mode: scope to records owned by this user."),
   scope: z2.string().optional().describe(
-    'List mode: filter to records carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+    'List mode: filter to records carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are reserved namespace names, registered like any other; others are namespaces you registered yourself.'
   ),
   startFrom: z2.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next. Works in both list and lookup mode."),
   limit: z2.number().int().min(1).max(MCP_MAX_LIMIT2).optional().describe(
@@ -9745,31 +9937,78 @@ var recordGet = ({ client, log }) => ({
 });
 var record_get_default = recordGet;
 
-// src/tools/record_create.ts
+// src/tools/record_batch_get.ts
 import { z as z4 } from "zod";
+var MAX_PAYLOAD_CHARS2 = 32e3;
+var MCP_MAX_IDS = 100;
 var inputSchema4 = {
-  type: z4.string().min(1, "type is required").describe('Record type / schema name (e.g. "task"). Must match an existing schema \u2014 see list_schemas.'),
-  fields: z4.record(z4.string(), z4.unknown()).describe(
+  ids: z4.array(z4.string()).min(1).max(MCP_MAX_IDS).describe(
+    `Record ids to fetch in one call (1-${MCP_MAX_IDS}). Any id you cannot access \u2014 nonexistent, wrong account, or outside your token's scope \u2014 is silently omitted from the response (no per-id existence signal); compare against the response's \`missingIds\` to see which requested ids came back empty.`
+  )
+};
+var recordBatchGet = ({ client, log }) => ({
+  name: "record_batch_get",
+  title: "Get multiple records by id in one call",
+  description: "Fetch several structured records by id in a single call (1-100 ids), each with its full payload \u2014 the same hydration record_get gives a single id. Use this instead of N record_get calls when you already hold several ids (e.g. a page of record_query/hybrid_search results). Any id you can't access is silently omitted from `data`; the response also returns `missingIds` \u2014 every requested id not present in `data` \u2014 so you can tell a partial result from a complete one. As with record_get, an oversized payload is truncated into a labelled `payloadPreview` rather than shipped whole.",
+  inputSchema: inputSchema4,
+  handler: async (args) => {
+    const ids = args.ids;
+    try {
+      const response = await client.records.batchGetRecords({ ids });
+      const records = response.data ?? [];
+      const data = records.map((record) => {
+        const item = { ...record };
+        if (record.payload !== void 0) {
+          const json = JSON.stringify(record.payload);
+          if (json.length > MAX_PAYLOAD_CHARS2) {
+            delete item.payload;
+            item.payloadPreview = json.slice(0, MAX_PAYLOAD_CHARS2);
+            item.payloadTruncated = true;
+            item.payloadTotalChars = json.length;
+          }
+        }
+        return item;
+      });
+      const returnedIds = new Set(records.map((r) => r.id));
+      const missingIds = ids.filter((id) => !returnedIds.has(id));
+      log.debug(
+        { tool: "record_batch_get", requested: ids.length, returned: data.length, missing: missingIds.length },
+        "record_batch_get ok"
+      );
+      return { content: [{ type: "text", text: JSON.stringify({ data, missingIds }, null, 2) }] };
+    } catch (err) {
+      log.warn({ tool: "record_batch_get", idsCount: ids?.length, err: String(err) }, "record_batch_get failed");
+      return toolError("record_batch_get", err);
+    }
+  }
+});
+var record_batch_get_default = recordBatchGet;
+
+// src/tools/record_create.ts
+import { z as z5 } from "zod";
+var inputSchema5 = {
+  type: z5.string().min(1, "type is required").describe('Record type / schema name (e.g. "task"). Must match an existing schema \u2014 see list_schemas.'),
+  fields: z5.record(z5.string(), z5.unknown()).describe(
     "The record payload \u2014 a JSON object of field\u2192value, validated against the type schema. Call list_schemas to learn required fields, types, and enum values. Every number must fall within the signed 64-bit range (a value outside it, or with >38 significant digits, is refused with a 400 naming the field) \u2014 send a larger whole number (e.g. a big external id) as a STRING, which stores it exactly and supports exact-match lookup."
   ),
-  externalId: z4.string().optional().describe(
+  externalId: z5.string().optional().describe(
     "Stable caller-supplied id. Immutable; unique per type. Re-creating with the same externalId returns the existing record (idempotent) \u2014 use it to make creates safely retryable."
   ),
-  indexMode: z4.enum(["HYBRID", "SEMANTIC", "TEXT", "NONE"]).optional().describe(
+  indexMode: z5.enum(["HYBRID", "SEMANTIC", "TEXT", "NONE"]).optional().describe(
     "Search-index strategy for this record, set at create only (immutable after). HYBRID (BM25 + dense), SEMANTIC (dense only), TEXT (BM25 only), NONE (store-only \u2014 never appears in hybrid_search/rag_ask; still retrievable by id and structured-field lookup). Omit to inherit the type schema's default; if the schema default is NONE and you want this record searchable, set it here \u2014 it cannot be changed later."
   ),
-  status: z4.string().optional().describe("Record lifecycle status. Defaults to ACTIVE server-side."),
-  folderId: z4.string().optional().describe("Group this record into a folder."),
-  userId: z4.string().optional().describe("Owning user id."),
-  scopes: z4.array(z4.string()).optional().describe(
-    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the record\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE record owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default.'
+  status: z5.string().optional().describe("Record lifecycle status. Defaults to ACTIVE server-side."),
+  folderId: z5.string().optional().describe("Group this record into a folder."),
+  userId: z5.string().optional().describe("Owning user id."),
+  scopes: z5.array(z5.string()).optional().describe(
+    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). `org` and `client` are reserved namespace names, registered like any other; others are namespaces you registered yourself. This is the record\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE record owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default.'
   )
 };
 var recordCreate = ({ client, log }) => ({
   name: "record_create",
   title: "Create a record",
   description: "Create a structured record of a given type. Provide `type` and `fields` (the payload, validated against the type schema \u2014 call list_schemas first to learn required fields and enums). Idempotent by `externalId`. Requires the key to allow records:c (and records:r to receive the existing record on a collision).",
-  inputSchema: inputSchema4,
+  inputSchema: inputSchema5,
   handler: async (args) => {
     const type = args.type;
     try {
@@ -9796,18 +10035,18 @@ var recordCreate = ({ client, log }) => ({
 var record_create_default = recordCreate;
 
 // src/tools/record_update.ts
-import { z as z5 } from "zod";
-var inputSchema5 = {
-  id: z5.string().optional().describe("The Vectros record id to update. Provide this OR externalId+type."),
-  externalId: z5.string().optional().describe(
+import { z as z6 } from "zod";
+var inputSchema6 = {
+  id: z6.string().optional().describe("The Vectros record id to update. Provide this OR externalId+type."),
+  externalId: z6.string().optional().describe(
     "Your caller-owned externalId \u2014 an alternative selector to `id` (requires `type`). Updates the record you created under that externalId without a manual record_query lookup first."
   ),
-  type: z5.string().optional().describe("Record type \u2014 REQUIRED when selecting by `externalId` (externalId is unique within a type)."),
-  fields: z5.record(z5.string(), z5.unknown()).describe(
+  type: z6.string().optional().describe("Record type \u2014 REQUIRED when selecting by `externalId` (externalId is unique within a type)."),
+  fields: z6.record(z6.string(), z6.unknown()).describe(
     "Field\u2192value changes DEEP-MERGED into the existing payload: keys you send overwrite (recursing into nested objects), a key set to `null` is deleted, and unspecified fields are preserved."
   ),
-  status: z5.string().optional().describe("Set the record lifecycle status (e.g. ARCHIVED) \u2014 archive/workflow without physical deletion."),
-  expectedVersion: z5.number().int().optional().describe(
+  status: z6.string().optional().describe("Set the record lifecycle status (e.g. ARCHIVED) \u2014 archive/workflow without physical deletion."),
+  expectedVersion: z6.number().int().optional().describe(
     "Optimistic concurrency: the version you last read. If the record changed since, the update is refused as a conflict (re-read and retry). Omit for last-write-wins."
   )
 };
@@ -9815,7 +10054,7 @@ var recordUpdate = ({ client, log }) => ({
   name: "record_update",
   title: "Update a record by id or externalId",
   description: "Update a record \u2014 select it by its Vectros `id` OR by your own `externalId` + `type` (the same key you passed to record_create, resolved for you). The provided `fields` are DEEP-MERGED into the existing payload (unspecified fields are preserved; a field set to `null` is deleted). Pass `expectedVersion` (the version you last read) for safe concurrent edits \u2014 a stale update is refused (409). Use `status` to archive without deleting. Requires the key to allow records:u.",
-  inputSchema: inputSchema5,
+  inputSchema: inputSchema6,
   handler: async (args) => {
     const id = args.id;
     const externalId = args.externalId;
@@ -9841,15 +10080,15 @@ var recordUpdate = ({ client, log }) => ({
 var record_update_default = recordUpdate;
 
 // src/tools/record_delete.ts
-import { z as z6 } from "zod";
-var inputSchema6 = {
-  id: z6.string().min(1, "id is required").describe("The Vectros record id to delete.")
+import { z as z7 } from "zod";
+var inputSchema7 = {
+  id: z7.string().min(1, "id is required").describe("The Vectros record id to delete.")
 };
 var recordDelete = ({ client, log }) => ({
   name: "record_delete",
   title: "Delete a record",
   description: "Permanently delete a record by id (leaves a tombstone). Requires the key to allow records:d \u2014 a key without it gets a permission error. To archive without deleting, use record_update to set status instead.",
-  inputSchema: inputSchema6,
+  inputSchema: inputSchema7,
   handler: async (args) => {
     const id = args.id;
     try {
@@ -9865,48 +10104,48 @@ var recordDelete = ({ client, log }) => ({
 var record_delete_default = recordDelete;
 
 // src/tools/rag_ask.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var SEARCH_MCP_DEFAULT_LIMIT = 5;
 var SEARCH_MCP_MAX_LIMIT = 50;
-var inputSchema7 = {
-  query: z7.string().min(1, "query must be non-empty").describe("Question to ground against retrieved content."),
-  instructions: z7.string().optional().describe(
+var inputSchema8 = {
+  query: z8.string().min(1, "query must be non-empty").describe("Question to ground against retrieved content."),
+  instructions: z8.string().optional().describe(
     'System prompt that overrides the default for the generation step \u2014 e.g. "answer only from the provided context, cite sources, be concise". Default: a generic answer-from-context instruction.'
   ),
-  model: z7.string().optional().describe(
+  model: z8.string().optional().describe(
     "Inference model alias (e.g. claude-haiku-4-5, claude-sonnet-5, claude-opus-4-8). Default = tier-appropriate Haiku. See GET /v1/models for the catalog the calling key can reach."
   ),
-  search: z7.object({
-    mode: z7.enum(["HYBRID", "TEXT", "SEMANTIC"]).optional().describe("Retrieval mode. Default HYBRID."),
-    limit: z7.number().int().min(1).max(SEARCH_MCP_MAX_LIMIT).optional().describe(
+  search: z8.object({
+    mode: z8.enum(["HYBRID", "TEXT", "SEMANTIC"]).optional().describe("Retrieval mode. Default HYBRID."),
+    limit: z8.number().int().min(1).max(SEARCH_MCP_MAX_LIMIT).optional().describe(
       `Passages to retrieve before generating (the grounding-corpus size). Default ${SEARCH_MCP_DEFAULT_LIMIT}; raise up to ${SEARCH_MCP_MAX_LIMIT} (the RAG search API max) for a broader corpus when the extra grounding is worth the larger prompt.`
     ),
     // Retrieval scoping — parity with hybrid_search so an agent can ground the
     // answer on a specific owner / folder / type / metadata subset, not just the
     // whole-tenant corpus.
-    userId: z7.string().optional().describe("Restrict retrieval to content owned by this user (Vectros UUID)."),
-    scope: z7.string().optional().describe(
-      'Restrict retrieval to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+    userId: z8.string().optional().describe("Restrict retrieval to content owned by this user (Vectros UUID)."),
+    scope: z8.string().optional().describe(
+      'Restrict retrieval to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are reserved namespace names, registered like any other; others are namespaces you registered yourself.'
     ),
-    folderId: z7.string().optional().describe("Restrict retrieval to this exact folder."),
-    rootFolderId: z7.string().optional().describe("Restrict retrieval to this folder and all its descendants."),
-    typeName: z7.string().optional().describe("Restrict record retrieval to this schema type."),
-    contentTypes: z7.array(z7.enum(["documents", "records"])).optional().describe('Narrow retrieval to content types. ["documents"] or ["records"]; omit for both.'),
-    filters: z7.record(z7.unknown()).optional().describe(
+    folderId: z8.string().optional().describe("Restrict retrieval to this exact folder."),
+    rootFolderId: z8.string().optional().describe("Restrict retrieval to this folder and all its descendants."),
+    typeName: z8.string().optional().describe("Restrict record retrieval to this schema type."),
+    contentTypes: z8.array(z8.enum(["documents", "records"])).optional().describe('Narrow retrieval to content types. ["documents"] or ["records"]; omit for both.'),
+    filters: z8.record(z8.unknown()).optional().describe(
       'Field-level metadata filters (AND-combined). Value = scalar (equality), array (OR-set), or operator map ($eq/$ne/$gt/$gte/$lt/$lte, $in/$nin). e.g. {"status":"open"}.'
     ),
-    createdAfter: z7.string().optional().describe("Restrict to content created at/after this ISO 8601 UTC timestamp."),
-    createdBefore: z7.string().optional().describe("Restrict to content created at/before this ISO 8601 UTC timestamp."),
-    requireComplete: z7.boolean().optional().describe("Fail closed (503) on a degraded search backend instead of grounding on partial results. Default false.")
+    createdAfter: z8.string().optional().describe("Restrict to content created at/after this ISO 8601 UTC timestamp."),
+    createdBefore: z8.string().optional().describe("Restrict to content created at/before this ISO 8601 UTC timestamp."),
+    requireComplete: z8.boolean().optional().describe("Fail closed (503) on a degraded search backend instead of grounding on partial results. Default false.")
   }).optional().describe("Retrieval params + scoping. Default mode HYBRID, limit " + SEARCH_MCP_DEFAULT_LIMIT + "."),
-  maxTokens: z7.number().int().min(1).optional().describe("Max output tokens."),
-  temperature: z7.number().min(0).max(1).optional().describe("Sampling temperature (0.0\u20131.0). Default 0.3 \u2014 lower favors deterministic, retrieval-grounded answers.")
+  maxTokens: z8.number().int().min(1).optional().describe("Max output tokens."),
+  temperature: z8.number().min(0).max(1).optional().describe("Sampling temperature (0.0\u20131.0). Default 0.3 \u2014 lower favors deterministic, retrieval-grounded answers.")
 };
 var ragAsk = ({ client, log }) => ({
   name: "rag_ask",
   title: "RAG ask (corpus-wide)",
   description: "Ask a question grounded against your tenant's indexed content. Vectros performs a hybrid search, injects the top-K passages into the prompt, and streams a model answer back. Scope retrieval with `search` (ownership, folder, type, metadata filters, date window) to ground on a subset \u2014 e.g. one patient or one folder \u2014 and steer generation with `instructions` / `temperature`. The full answer is returned as a single response; progress notifications keep the call alive during the 30-45s generation window. Inference runs in-perimeter against AWS Bedrock \u2014 PHI never leaves the BAA boundary.",
-  inputSchema: inputSchema7,
+  inputSchema: inputSchema8,
   handler: async (args, extra) => {
     try {
       const searchArg = args.search ?? {};
@@ -9982,20 +10221,20 @@ var ragAsk = ({ client, log }) => ({
 var rag_ask_default = ragAsk;
 
 // src/tools/document_ask.ts
-import { z as z8 } from "zod";
-var inputSchema8 = {
-  documentId: z8.string().min(1, "documentId is required").describe("ID of the document to ask against."),
-  prompt: z8.string().min(1, "prompt is required").describe("Question to ask about the document."),
-  model: z8.string().optional().describe(
+import { z as z9 } from "zod";
+var inputSchema9 = {
+  documentId: z9.string().min(1, "documentId is required").describe("ID of the document to ask against."),
+  prompt: z9.string().min(1, "prompt is required").describe("Question to ask about the document."),
+  model: z9.string().optional().describe(
     "Inference model alias. Default = tier-appropriate Haiku. See GET /v1/models for the catalog the calling key can reach."
   ),
-  maxTokens: z8.number().int().min(1).optional().describe("Max output tokens.")
+  maxTokens: z9.number().int().min(1).optional().describe("Max output tokens.")
 };
 var documentAsk = ({ client, log }) => ({
   name: "document_ask",
   title: "Document ask (single-document)",
   description: "Ask a question against a single indexed document. Returns a grounded answer with the document context that informed it. For documents exceeding the input-token cap, the API returns a structured 413 with `estimatedTokens` and `limitTokens`. Inference runs in-perimeter against AWS Bedrock \u2014 PHI never leaves the BAA boundary.",
-  inputSchema: inputSchema8,
+  inputSchema: inputSchema9,
   handler: async (args, extra) => {
     try {
       const stream = await client.inference.documentAsk({
@@ -10054,18 +10293,18 @@ var documentAsk = ({ client, log }) => ({
 var document_ask_default = documentAsk;
 
 // src/tools/list_schemas.ts
-import { z as z9 } from "zod";
-var inputSchema9 = {
-  userId: z9.string().optional().describe(
+import { z as z10 } from "zod";
+var inputSchema10 = {
+  userId: z10.string().optional().describe(
     "Filter to schemas visible to a specific user. Optional; default returns all schemas the credential can see."
   ),
-  scope: z9.string().optional().describe(
-    'Filter to schemas carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces. Optional; default returns all schemas the credential can see.'
+  scope: z10.string().optional().describe(
+    'Filter to schemas carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "group:eng-team"). `org` and `client` are reserved namespace names, registered like any other. Optional; default returns all schemas the credential can see.'
   ),
-  surface: z9.enum(["record", "document", "user", "entity"]).optional().describe(
+  surface: z10.enum(["record", "document", "user", "entity"]).optional().describe(
     "Filter to schemas bindable to this surface \u2014 e.g. `document` to list only document types, or `record` for record types. Identity entities in any namespace (org/client/one you registered) bind under the single `entity` surface; `user` and `entity` are account-wide. Optional."
   ),
-  recordType: z9.string().optional().describe(
+  recordType: z10.string().optional().describe(
     'Resolve the single schema for this record type (its natural handle, e.g. "patient") instead of listing \u2014 returns a one-element result, or empty if none. Combine with `surface=user|entity` for an identity schema. Takes precedence over userId. Optional.'
   )
 };
@@ -10073,7 +10312,7 @@ var listSchemas = ({ client, log }) => ({
   name: "list_schemas",
   title: "List record schemas",
   description: 'List the structured-record schema catalog for your tenant. Each schema describes a record type (e.g. "patient", "clinical_note") \u2014 its fields, lookup-indexed fields, and capabilities. Use this to discover what record types exist before calling `record_query`. Filter with `surface` (record/document/user/entity \u2014 e.g. only document types), `recordType` (resolve one schema by its type name), or `userId`/`scope`; default returns everything the credential can see.',
-  inputSchema: inputSchema9,
+  inputSchema: inputSchema10,
   handler: async (args) => {
     const userId = args.userId;
     const scope = args.scope;
@@ -10099,18 +10338,18 @@ var listSchemas = ({ client, log }) => ({
 var list_schemas_default = listSchemas;
 
 // src/tools/document_get.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var MAX_TEXT_CHARS = 32e3;
-var inputSchema10 = {
-  documentId: z10.string().optional().describe("The document ID returned by document_ingest or hybrid_search. Provide this OR externalId+type."),
-  externalId: z10.string().optional().describe(
+var inputSchema11 = {
+  documentId: z11.string().optional().describe("The document ID returned by document_ingest or hybrid_search. Provide this OR externalId+type."),
+  externalId: z11.string().optional().describe(
     "Your caller-owned externalId \u2014 an alternative selector to `documentId` (requires `type`). Fetches the document you ingested under that externalId without a manual lookup first."
   ),
-  type: z10.string().optional().describe("Document type \u2014 REQUIRED when selecting by `externalId` (externalId is unique within a type)."),
-  includeText: z10.boolean().optional().describe(
+  type: z11.string().optional().describe("Document type \u2014 REQUIRED when selecting by `externalId` (externalId is unique within a type)."),
+  includeText: z11.boolean().optional().describe(
     "If true, fetch and include the document text (capped at ~8K tokens, truncated: true flag if cut). Default false \u2014 metadata only. For larger documents, prefer `document_ask` over dumping text into context."
   ),
-  includeDownloadUrl: z10.boolean().optional().describe(
+  includeDownloadUrl: z11.boolean().optional().describe(
     "If true, also return a short-lived presigned `downloadUrl` for the original file (file-backed documents only \u2014 the way to retrieve the raw bytes of a document ingested via file mode). Default false. Unavailable for text-only documents \u2014 `downloadAvailable: false` is set instead."
   )
 };
@@ -10127,7 +10366,7 @@ var documentGet = ({ client, log }) => ({
   name: "document_get",
   title: "Get document metadata (and optionally text)",
   description: "Fetch metadata for a single document \u2014 select it by its Vectros `documentId` OR by your own `externalId` + `type` (resolved for you). Pass `includeText: true` to also fetch the text body (capped at ~8K tokens; `truncated: true` flag if cut). Text is available for every text-ingested document and for file-ingested documents unless they were uploaded with `storeText: false` (extracted text discarded after indexing) \u2014 then `textAvailable: false` is set; the original file is still retrievable via `includeDownloadUrl`. Pass `includeDownloadUrl: true` to also get a short-lived presigned `downloadUrl` for the original file (file-backed documents only). Returns the full document metadata, including its lifecycle `status` (ACTIVE, or ARCHIVED when soft-retracted from search \u2014 restorable via document_update) and its processing `indexStatus`. When `indexStatus` is FAILED the response also carries `indexFailure` with a machine-readable `code` telling you whether the content is still findable \u2014 e.g. TEXT_INDEX_FAILED / VECTOR_LIMIT_EXCEEDED (one leg still serves it) vs INDEXING_FAILED (not findable by search at all). Branch on `code`, not on the message.",
-  inputSchema: inputSchema10,
+  inputSchema: inputSchema11,
   handler: async (args) => {
     const documentId = args.documentId;
     const externalId = args.externalId;
@@ -10192,28 +10431,28 @@ var documentGet = ({ client, log }) => ({
 var document_get_default = documentGet;
 
 // src/tools/document_query.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var MCP_DEFAULT_LIMIT3 = 3;
 var MCP_MAX_LIMIT3 = 100;
-var inputSchema11 = {
+var inputSchema12 = {
   // Lookup-mode args — provide `field` plus EXACTLY ONE of: value | from+to | prefix.
-  field: z11.string().optional().describe("Lookup mode: name of the lookup-indexed field to query by."),
-  value: z11.string().optional().describe("Lookup mode (equality): exact-match value for `field`. Works on sensitive fields too."),
-  from: z11.string().optional().describe("Lookup mode (range): inclusive lower bound; requires `to`. Range-enabled, non-sensitive fields only."),
-  to: z11.string().optional().describe("Lookup mode (range): inclusive upper bound; requires `from`."),
-  prefix: z11.string().optional().describe("Lookup mode (prefix): match values starting with this. Range-enabled string fields only."),
-  order: z11.enum(["asc", "desc"]).optional().describe(
+  field: z12.string().optional().describe("Lookup mode: name of the lookup-indexed field to query by."),
+  value: z12.string().optional().describe("Lookup mode (equality): exact-match value for `field`. Works on sensitive fields too."),
+  from: z12.string().optional().describe("Lookup mode (range): inclusive lower bound; requires `to`. Range-enabled, non-sensitive fields only."),
+  to: z12.string().optional().describe("Lookup mode (range): inclusive upper bound; requires `from`."),
+  prefix: z12.string().optional().describe("Lookup mode (prefix): match values starting with this. Range-enabled string fields only."),
+  order: z12.enum(["asc", "desc"]).optional().describe(
     "Lookup mode: sort direction by the looked-up field. `asc` (default) or `desc` \u2014 use `desc` with a range/prefix lookup to get the most-recent / highest values first (e.g. latest-N). Ignored in list mode."
   ),
-  type: z11.string().optional().describe("Lookup mode: the document type (the bound schema's type). Required with `field`."),
+  type: z12.string().optional().describe("Lookup mode: the document type (the bound schema's type). Required with `field`."),
   // List-mode args:
-  folderId: z11.string().optional().describe("List mode: only documents in this folder (Vectros folder id)."),
-  userId: z11.string().optional().describe("List mode: scope to documents owned by this user."),
-  scope: z11.string().optional().describe(
-    'List mode: filter to documents carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+  folderId: z12.string().optional().describe("List mode: only documents in this folder (Vectros folder id)."),
+  userId: z12.string().optional().describe("List mode: scope to documents owned by this user."),
+  scope: z12.string().optional().describe(
+    'List mode: filter to documents carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are reserved namespace names, registered like any other; others are namespaces you registered yourself.'
   ),
-  startFrom: z11.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next. Works in both list and lookup mode."),
-  limit: z11.number().int().min(1).max(MCP_MAX_LIMIT3).optional().describe(
+  startFrom: z12.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next. Works in both list and lookup mode."),
+  limit: z12.number().int().min(1).max(MCP_MAX_LIMIT3).optional().describe(
     `Max documents per page. Defaults to a low ${MCP_DEFAULT_LIMIT3} to protect the agent context window; raise up to ${MCP_MAX_LIMIT3} (the documents API max) in one call when you can accept the larger payload, or page with \`startFrom\` instead.`
   )
 };
@@ -10221,7 +10460,7 @@ var documentQuery = ({ client, log }) => ({
   name: "document_query",
   title: "Document query (list or lookup)",
   description: "Query document metadata. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields (equality only there); range/prefix need a range-enabled field.\n  \u2022 List: omit `field`; optionally filter by `folderId`/`userId`/`scope` (`namespace:value`).\nReturns a `{ data, nextCursor }` page: `data` holds up to `limit` documents (default 3, max 100 \u2014 raise it in one call when you can accept the payload), and a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page. Mode is auto-detected. Use document_get for the full text/download URL of one document.",
-  inputSchema: inputSchema11,
+  inputSchema: inputSchema12,
   handler: async (args) => {
     const limit = args.limit ?? MCP_DEFAULT_LIMIT3;
     const field = args.field;
@@ -10301,29 +10540,29 @@ var documentQuery = ({ client, log }) => ({
 var document_query_default = documentQuery;
 
 // src/tools/document_update.ts
-import { z as z12 } from "zod";
-var inputSchema12 = {
-  documentId: z12.string().optional().describe("The Vectros document id to update. Provide this OR externalId+type."),
-  externalId: z12.string().optional().describe(
+import { z as z13 } from "zod";
+var inputSchema13 = {
+  documentId: z13.string().optional().describe("The Vectros document id to update. Provide this OR externalId+type."),
+  externalId: z13.string().optional().describe(
     "Your caller-owned externalId \u2014 an alternative selector to `documentId` (requires `type`). Updates the document you ingested under that externalId without a manual lookup first."
   ),
-  type: z12.string().optional().describe("Document type \u2014 REQUIRED when selecting by `externalId` (externalId is unique within a type)."),
-  title: z12.string().optional().describe("New title. Omit to keep the current title."),
-  fields: z12.record(z12.string(), z12.unknown()).optional().describe(
+  type: z13.string().optional().describe("Document type \u2014 REQUIRED when selecting by `externalId` (externalId is unique within a type)."),
+  title: z13.string().optional().describe("New title. Omit to keep the current title."),
+  fields: z13.record(z13.string(), z13.unknown()).optional().describe(
     "Typed-payload field\u2192value changes DEEP-MERGED into the existing payload (a field set to `null` is deleted; unspecified fields preserved). Omit to leave the payload unchanged."
   ),
-  text: z12.string().optional().describe(
+  text: z13.string().optional().describe(
     "New raw text body. Supplying it re-ingests the document body and re-queues it for indexing, so the search index reflects the edit (text-ingested documents only \u2014 not file-backed ones). Omit to leave the stored text unchanged. This is the in-place alternative to re-ingesting with upsert:true."
   ),
-  folderId: z12.string().optional().describe("Move the document into this folder (cannot be cleared once set)."),
-  status: z12.enum(["ACTIVE", "ARCHIVED"]).optional().describe(
+  folderId: z13.string().optional().describe("Move the document into this folder (cannot be cleared once set)."),
+  status: z13.enum(["ACTIVE", "ARCHIVED"]).optional().describe(
     "Lifecycle status. `ARCHIVED` soft-retracts the document \u2014 it is pulled from search and recall but kept and recoverable; set it back to `ACTIVE` to re-index and restore it. The way to retire superseded content when the credential has no delete authority. Omit to leave unchanged."
   ),
-  userId: z12.string().optional().describe("Reassign the owning user (Vectros UUID)."),
-  scopes: z12.array(z12.string()).optional().describe(
-    'Reassign scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]) \u2014 the COMPLETE new parent set. `org`/`client` are built-in namespaces. Omit to leave ownership unchanged; `[]` clears it (private to the owning user).'
+  userId: z13.string().optional().describe("Reassign the owning user (Vectros UUID)."),
+  scopes: z13.array(z13.string()).optional().describe(
+    'Reassign scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]) \u2014 the COMPLETE new parent set. `org`/`client` are reserved namespace names, registered like any other. Omit to leave ownership unchanged; `[]` clears it (private to the owning user).'
   ),
-  expectedVersion: z12.number().int().optional().describe(
+  expectedVersion: z13.number().int().optional().describe(
     "Optimistic concurrency: the version you last read. If the document changed since, the update is refused as a conflict (re-read and retry). Omit for last-write-wins."
   )
 };
@@ -10331,7 +10570,7 @@ var documentUpdate = ({ client, log }) => ({
   name: "document_update",
   title: "Update a document",
   description: 'Update a document \u2014 select it by its Vectros `documentId` OR by your own `externalId` + `type` (resolved for you). `fields` are DEEP-MERGED into the existing typed payload (unspecified fields preserved; a field set to `null` is deleted); title/folderId/status/ownership are updated when provided and preserved otherwise. Supply `text` to re-ingest and re-index the document body in place (text documents only). Set `status: "ARCHIVED"` to soft-retract a document (pulled from search, kept and recoverable) and `status: "ACTIVE"` to restore it. Pass `expectedVersion` (the version you last read) for safe concurrent edits \u2014 a stale update is refused (409). Requires the key to allow documents:u.',
-  inputSchema: inputSchema12,
+  inputSchema: inputSchema13,
   handler: async (args) => {
     const documentId = args.documentId;
     const externalId = args.externalId;
@@ -10371,15 +10610,15 @@ var documentUpdate = ({ client, log }) => ({
 var document_update_default = documentUpdate;
 
 // src/tools/document_delete.ts
-import { z as z13 } from "zod";
-var inputSchema13 = {
-  documentId: z13.string().min(1, "documentId is required").describe("The Vectros document id to delete.")
+import { z as z14 } from "zod";
+var inputSchema14 = {
+  documentId: z14.string().min(1, "documentId is required").describe("The Vectros document id to delete.")
 };
 var documentDelete = ({ client, log }) => ({
   name: "document_delete",
   title: "Delete a document",
   description: 'Permanently delete a document by id (removes it and its indexed content). Requires the key to allow documents:d \u2014 a key without it gets a permission error. To archive without deleting, use document_update to set status: "ARCHIVED" instead (recoverable, and needs no delete authority).',
-  inputSchema: inputSchema13,
+  inputSchema: inputSchema14,
   handler: async (args) => {
     const documentId = args.documentId;
     try {
@@ -10397,18 +10636,18 @@ var documentDelete = ({ client, log }) => ({
 var document_delete_default = documentDelete;
 
 // src/tools/folder_query.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var MCP_DEFAULT_LIMIT4 = 10;
 var MCP_MAX_LIMIT4 = 100;
-var inputSchema14 = {
-  id: z14.string().optional().describe("Get mode: fetch this single folder by id."),
-  parentId: z14.string().optional().describe("List mode: direct children of this folder (tree navigation). Omit for a flat tenant list."),
-  userId: z14.string().optional().describe("List mode: scope to folders owned by this user."),
-  scope: z14.string().optional().describe(
-    'List mode: filter to folders carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+var inputSchema15 = {
+  id: z15.string().optional().describe("Get mode: fetch this single folder by id."),
+  parentId: z15.string().optional().describe("List mode: direct children of this folder (tree navigation). Omit for a flat tenant list."),
+  userId: z15.string().optional().describe("List mode: scope to folders owned by this user."),
+  scope: z15.string().optional().describe(
+    'List mode: filter to folders carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are reserved namespace names, registered like any other; others are namespaces you registered yourself.'
   ),
-  startFrom: z14.string().optional().describe("List mode: pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next."),
-  limit: z14.number().int().min(1).max(MCP_MAX_LIMIT4).optional().describe(
+  startFrom: z15.string().optional().describe("List mode: pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next."),
+  limit: z15.number().int().min(1).max(MCP_MAX_LIMIT4).optional().describe(
     `List mode: max folders per page. Default 10; raise up to ${MCP_MAX_LIMIT4} (the folders API max) in one call when you can accept the larger page, or page with \`startFrom\`.`
   )
 };
@@ -10416,7 +10655,7 @@ var folderQuery = ({ client, log }) => ({
   name: "folder_query",
   title: "Folder query (list or get)",
   description: "Read folders. Two modes:\n  \u2022 Get: pass `id` \u2192 returns the single folder.\n  \u2022 List: omit `id`; pass `parentId` for a folder's direct children (tree navigation) or omit for a flat tenant list. Optionally filter by `userId` or `scope` (`namespace:value`).\nList mode returns `{ data, nextCursor }` (default 10, max 100 per page \u2014 raise it in one call when you can accept the larger page); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page through all folders. Get mode returns the single folder object.",
-  inputSchema: inputSchema14,
+  inputSchema: inputSchema15,
   handler: async (args) => {
     const id = args.id;
     try {
@@ -10446,22 +10685,22 @@ var folderQuery = ({ client, log }) => ({
 var folder_query_default = folderQuery;
 
 // src/tools/folder_create.ts
-import { z as z15 } from "zod";
-var inputSchema15 = {
-  name: z15.string().min(1, "name is required").describe("Folder display name."),
-  description: z15.string().optional().describe("Optional description of the folder's purpose."),
-  parentId: z15.string().optional().describe("Parent folder id \u2014 places the folder under this parent. Omit for the context default root. Create-only."),
-  slug: z15.string().optional().describe("Optional stable slug (sibling-unique; idempotency key). Lowercase letters/digits/hyphens. Derived from name when omitted."),
-  userId: z15.string().optional().describe("Owning user (Vectros UUID)."),
-  scopes: z15.array(z15.string()).optional().describe(
-    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the folder\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE folder owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default.'
+import { z as z16 } from "zod";
+var inputSchema16 = {
+  name: z16.string().min(1, "name is required").describe("Folder display name."),
+  description: z16.string().optional().describe("Optional description of the folder's purpose."),
+  parentId: z16.string().optional().describe("Parent folder id \u2014 places the folder under this parent. Omit for the context default root. Create-only."),
+  slug: z16.string().optional().describe("Optional stable slug (sibling-unique; idempotency key). Lowercase letters/digits/hyphens. Derived from name when omitted."),
+  userId: z16.string().optional().describe("Owning user (Vectros UUID)."),
+  scopes: z16.array(z16.string()).optional().describe(
+    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). `org` and `client` are reserved namespace names, registered like any other; others are namespaces you registered yourself. This is the folder\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE folder owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default.'
   )
 };
 var folderCreate = ({ client, log }) => ({
   name: "folder_create",
   title: "Create a folder",
   description: "Create a folder to organize documents and records. Pass `parentId` to nest it (create-only \u2014 folders cannot be moved later). Idempotent by `slug` within the parent. Requires the key to allow folders:c (and folders:r to receive the existing folder on a collision).",
-  inputSchema: inputSchema15,
+  inputSchema: inputSchema16,
   handler: async (args) => {
     try {
       const folder = await client.folders.createFolder({
@@ -10485,16 +10724,16 @@ var folderCreate = ({ client, log }) => ({
 var folder_create_default = folderCreate;
 
 // src/tools/folder_update.ts
-import { z as z16 } from "zod";
-var inputSchema16 = {
-  id: z16.string().min(1, "id is required").describe("The Vectros folder id to update."),
-  name: z16.string().optional().describe("New folder name. Omit to keep the current name."),
-  description: z16.string().optional().describe("New description. Omit to leave unchanged."),
-  userId: z16.string().optional().describe("Reassign the owning user (Vectros UUID)."),
-  scopes: z16.array(z16.string()).optional().describe(
-    'Reassign scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]) \u2014 the COMPLETE new parent set. `org`/`client` are built-in namespaces. Omit to leave ownership unchanged; `[]` clears it (private to the owning user).'
+import { z as z17 } from "zod";
+var inputSchema17 = {
+  id: z17.string().min(1, "id is required").describe("The Vectros folder id to update."),
+  name: z17.string().optional().describe("New folder name. Omit to keep the current name."),
+  description: z17.string().optional().describe("New description. Omit to leave unchanged."),
+  userId: z17.string().optional().describe("Reassign the owning user (Vectros UUID)."),
+  scopes: z17.array(z17.string()).optional().describe(
+    'Reassign scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]) \u2014 the COMPLETE new parent set. `org`/`client` are reserved namespace names, registered like any other. Omit to leave ownership unchanged; `[]` clears it (private to the owning user).'
   ),
-  expectedVersion: z16.number().int().optional().describe(
+  expectedVersion: z17.number().int().optional().describe(
     "Optimistic concurrency: the version you last read. If the folder changed since, the update is refused as a conflict (re-read and retry). Omit for last-write-wins."
   )
 };
@@ -10502,7 +10741,7 @@ var folderUpdate = ({ client, log }) => ({
   name: "folder_update",
   title: "Update a folder",
   description: "Update a folder's name / description / ownership by id (RFC-7386 merge \u2014 omitted fields preserved). Pass `expectedVersion` (the version you last read) for safe concurrent edits \u2014 a stale update is refused (409). Folders cannot be moved (re-parenting is not supported by the API). Requires the key to allow folders:u.",
-  inputSchema: inputSchema16,
+  inputSchema: inputSchema17,
   handler: async (args) => {
     const id = args.id;
     const name = args.name;
@@ -10529,15 +10768,15 @@ var folderUpdate = ({ client, log }) => ({
 var folder_update_default = folderUpdate;
 
 // src/tools/folder_delete.ts
-import { z as z17 } from "zod";
-var inputSchema17 = {
-  id: z17.string().min(1, "id is required").describe("The Vectros folder id to delete.")
+import { z as z18 } from "zod";
+var inputSchema18 = {
+  id: z18.string().min(1, "id is required").describe("The Vectros folder id to delete.")
 };
 var folderDelete = ({ client, log }) => ({
   name: "folder_delete",
   title: "Delete a folder",
   description: "Permanently delete a folder by id. Requires the key to allow folders:d \u2014 a key without it gets a permission error. Protected folders (e.g. a context root) cannot be deleted.",
-  inputSchema: inputSchema17,
+  inputSchema: inputSchema18,
   handler: async (args) => {
     const id = args.id;
     try {
@@ -10553,14 +10792,14 @@ var folderDelete = ({ client, log }) => ({
 var folder_delete_default = folderDelete;
 
 // src/tools/current_identity.ts
-var inputSchema18 = {
+var inputSchema19 = {
   // No args — current_identity describes the current credential.
 };
 var currentIdentity = ({ log, apiKey, environment }) => ({
   name: "current_identity",
   title: "Current identity (tenant + principal scope)",
-  description: "Describe the credential the MCP server is operating under. Returns tenantId, environment (staging|production), principalType (root_key|scoped_key|token), principalKeyId, principalLabel, and (for scoped credentials) allowedActions plus dataScope \u2014 the credential's reach as { userId, scopes[] }, where each scope is a `namespace:value` string (e.g. \"org:<uuid>\"). Also reports mcpServerVersion (this server's own package version) and sdkVersion (the bundled @vectros-ai/sdk version) so a caller can tell what build it's talking to. Use this when the user asks 'what can you do here?', 'what tenant am I in?', or 'what version is this?'. Calls GET /v1/ping under the hood.",
-  inputSchema: inputSchema18,
+  description: "Describe the credential the MCP server is operating under. Returns tenantId, environment (staging|production), principalType (root_key|scoped_key|token), principalKeyId, principalLabel, and (for scoped credentials) allowedActions plus dataScope \u2014 the credential's verb+ownership reach as { userId, scopes[] }, where each scope is a `namespace:value` string (e.g. \"org:<uuid>\"). Note: this does not yet include granted_capabilities (member-lifecycle / forensic-read / context-directory-read / delegate-mint) \u2014 a separate reach dimension a scope clause can carry as of API 0.40.0 that /v1/ping does not report yet, so allowedActions+dataScope may understate a credential's true reach. Also reports mcpServerVersion (this server's own package version) and sdkVersion (the bundled @vectros-ai/sdk version) so a caller can tell what build it's talking to. Use this when the user asks 'what can you do here?', 'what tenant am I in?', or 'what version is this?'. Calls GET /v1/ping under the hood.",
+  inputSchema: inputSchema19,
   handler: async () => {
     try {
       const identity = await resolveIdentity({ log, apiKey, environment });
@@ -10576,7 +10815,7 @@ var currentIdentity = ({ log, apiKey, environment }) => ({
 var current_identity_default = currentIdentity;
 
 // src/tools/document_ingest.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 import { readFile, realpath } from "fs/promises";
 import { basename, extname, resolve, relative, isAbsolute } from "path";
 var IngestPathError = class extends Error {
@@ -10651,45 +10890,45 @@ function inferMimeType(filePath) {
   const ext = extname(filePath).toLowerCase();
   return EXT_TO_MIME[ext] ?? "application/octet-stream";
 }
-var inputSchema19 = {
-  title: z18.string().min(1, "title is required").describe("Human-readable document title \u2014 appears in search results and the UI."),
-  indexMode: z18.enum(["HYBRID", "SEMANTIC", "TEXT", "NONE"]).optional().describe(
+var inputSchema20 = {
+  title: z19.string().min(1, "title is required").describe("Human-readable document title \u2014 appears in search results and the UI."),
+  indexMode: z19.enum(["HYBRID", "SEMANTIC", "TEXT", "NONE"]).optional().describe(
     "Index strategy. HYBRID (BM25 + dense, default; best for general retrieval), SEMANTIC (dense only; concept-driven queries), TEXT (BM25 only; exact-match / keyword), NONE (store-only / archival \u2014 retrievable by id and structured-field lookup but never in search results). Omit to inherit the bound schema's default."
   ),
-  externalId: z18.string().optional().describe(
+  externalId: z19.string().optional().describe(
     'Stable caller-supplied id. Immutable; unique per type within your context. Re-ingesting with the same externalId returns the existing document (idempotent) instead of creating a duplicate \u2014 use it to make ingests safely retryable and as the key other records reference. Mirrors record_create. Receiving the existing document back is a read of it and needs documents:r in addition to documents:c; a create-only key gets an "already exists" error instead of the document.'
   ),
-  upsert: z18.boolean().optional().describe(
+  upsert: z19.boolean().optional().describe(
     "When true, re-ingesting an existing externalId OVERWRITES that document and re-indexes the new body (text mode) / re-uploads and re-indexes the new file (file mode), instead of returning the existing one unchanged. This is the curation/re-sync primitive: edit a source, re-ingest with upsert:true, and the search index reflects the new content. Requires the documents:u scope. IMPORTANT: pass the SAME schemaId (and type) you used originally \u2014 externalId is unique WITHIN a type, so omitting schemaId resolves in the untyped namespace and mints a duplicate instead of updating. The response `created` flag confirms which happened (created:true = a new document was minted)."
   ),
-  schemaId: z18.string().optional().describe(
+  schemaId: z19.string().optional().describe(
     "Bind this document to a record schema. When set, `payload` is validated against the schema and its lookup fields become directly queryable via document_query (records parity). Resolve a schema id from its type via list_schemas. Omit for an untyped document."
   ),
-  payload: z18.record(z18.string(), z18.unknown()).optional().describe(
+  payload: z19.record(z19.string(), z19.unknown()).optional().describe(
     "The document's structured data \u2014 a flat key/value object. With `schemaId`, declared fields are validated and lookup fields indexed; undeclared keys pass through as free-form and are searchable via the hybrid_search `filters` param. Without a schema it is stored as free-form metadata. Every number must fall within the signed 64-bit range \u2014 send a larger whole number as a STRING (stored exactly, exact-match lookup), else the ingest is refused with a 400 naming the field."
   ),
   // Inline text mode (mutually exclusive with filePath):
-  text: z18.string().min(1).optional().describe("Text body to ingest inline. Mutually exclusive with filePath. Either text or filePath is required."),
-  storeText: z18.boolean().optional().describe(
+  text: z19.string().min(1).optional().describe("Text body to ingest inline. Mutually exclusive with filePath. Either text or filePath is required."),
+  storeText: z19.boolean().optional().describe(
     "FILE MODE ONLY. Whether the uploaded file's EXTRACTED text is retained after indexing (default true), fixed at ingest. true keeps the extracted text retrievable via document_get(includeText:true) and usable by document_ask; false discards it once indexing completes \u2014 search still works and the original file remains downloadable, but includeText returns textAvailable:false and document_ask is unavailable. NOT accepted with `text`: a text-ingested body is the document itself and is ALWAYS retained, so the backend has no storeText knob on the text path \u2014 passing it with `text` is rejected rather than silently ignored."
   ),
   // File upload mode (mutually exclusive with text; stdio-transport-only):
-  filePath: z18.string().min(1).optional().describe(
+  filePath: z19.string().min(1).optional().describe(
     "Local filesystem path to upload. Mutually exclusive with text. STDIO TRANSPORT ONLY \u2014 rejected on HTTP transport (remote MCP servers can't read your filesystem; use text mode or call the SDK's uploadDocument directly). Must resolve INSIDE the configured ingest root (VECTROS_MCP_INGEST_ROOT, else the server's working directory); paths that escape it (traversal/absolute/symlink) or match a sensitive pattern are rejected."
   ),
-  fileType: z18.string().optional().describe('MIME type of the file (e.g. "application/pdf"). Inferred from filePath extension if omitted.'),
+  fileType: z19.string().optional().describe('MIME type of the file (e.g. "application/pdf"). Inferred from filePath extension if omitted.'),
   // Common (both modes):
-  folderId: z18.string().optional().describe("Optional folder to ingest into. Default: tenant root."),
-  userId: z18.string().optional().describe("Owning user ID. Optional."),
-  scopes: z18.array(z18.string()).optional().describe(
-    "TEXT MODE ONLY. Scope ownership as `namespace:value` entries, at most 2 (e.g. [\"org:<uuid>\", \"group:eng-team\"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the document's COMPLETE scope declaration and values must come from the credential's own identity. An empty array `[]` creates a PRIVATE document owned by the calling user alone. Omit to stamp the credential's full identity \u2014 the default. Rejected with `filePath` (file uploads do not accept a scope declaration): a file-uploaded document is stamped with the credential's full identity."
+  folderId: z19.string().optional().describe("Optional folder to ingest into. Default: tenant root."),
+  userId: z19.string().optional().describe("Owning user ID. Optional."),
+  scopes: z19.array(z19.string()).optional().describe(
+    "TEXT MODE ONLY. Scope ownership as `namespace:value` entries, at most 2 (e.g. [\"org:<uuid>\", \"group:eng-team\"]). `org` and `client` are reserved namespace names, registered like any other; others are namespaces you registered yourself. This is the document's COMPLETE scope declaration and values must come from the credential's own identity. An empty array `[]` creates a PRIVATE document owned by the calling user alone. Omit to stamp the credential's full identity \u2014 the default. Rejected with `filePath` (file uploads do not accept a scope declaration): a file-uploaded document is stamped with the credential's full identity."
   )
 };
 var documentIngest = ({ client, log, transport, ingestRoot }) => ({
   name: "document_ingest",
   title: "Ingest a new document (text body or file upload)",
   description: "Create a new document in your Vectros tenant. Two modes:\n  \u2022 Text mode: pass `text` (string body). Single-call. Use for crawled content, notes, generated text.\n  \u2022 File mode: pass `filePath` (local path on the MCP server's host machine). STDIO-TRANSPORT ONLY \u2014 rejected on HTTP transport. MCP server reads the bytes, requests a presigned upload URL, and PUTs them. Returns when the upload is accepted (indexStatus: PENDING_INDEX); poll with `document_get` until indexStatus is INDEXED.\nEither `text` or `filePath` must be present; both is an error. Idempotent by `externalId` (re-ingest returns the existing document, not a duplicate \u2014 requires documents:r in addition to documents:c, since being handed the existing document is a read of it). To UPDATE an existing document instead \u2014 re-index an edited body \u2014 pass `upsert:true` with the same `externalId` (and the same `schemaId`); this is the re-sync primitive for keeping a knowledge base current. Pass `schemaId` + `payload` for a typed, lookup-queryable document (records parity). indexMode defaults to HYBRID for untyped documents (omit to inherit a bound schema's default). storeText is a FILE-MODE knob (default true): false discards the uploaded file's extracted text after indexing (search + file download keep working; text retrieval and document_ask do not). Text-mode bodies are always retained, so storeText is not accepted with `text`.",
-  inputSchema: inputSchema19,
+  inputSchema: inputSchema20,
   handler: async (args) => {
     const title = args.title;
     const text = args.text;
@@ -10841,39 +11080,43 @@ var documentIngest = ({ client, log, transport, ingestRoot }) => ({
 var document_ingest_default = documentIngest;
 
 // src/tools/lookup_principal.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var MCP_DEFAULT_LIMIT5 = 10;
 var MCP_MAX_LIMIT5 = 100;
-var inputSchema20 = {
-  kind: z19.string().describe(
-    'Which principal to look up: "user" (the fixed principal surface), or an entity namespace \u2014 "org", "client" (built in), or a namespace you registered.'
+var inputSchema21 = {
+  kind: z20.string().describe(
+    'Which principal to look up: "user" (the fixed principal surface), or an entity namespace \u2014 "org", "client" (reserved, registered like any other), or a namespace you registered.'
   ),
-  externalId: z19.string().optional().describe(
+  externalId: z20.string().optional().describe(
     "Resolve mode: your own stable identifier for the principal. Returns the single matching principal (with its Vectros UUID), or an empty array if none. The fastest path to the UUID the ownership filters need. Takes precedence if both this and a `field` lookup are supplied."
   ),
+  contextId: z20.string().optional().describe(
+    "Entity kinds only (not `user`, which is always tenant-wide): the app context to look up entities in, for a namespace registered as context-owned rather than tenant-wide. A context-confined credential's own context is used automatically without this; supply it to name a context explicitly (required for an unconfined/root credential to reach a context-owned namespace). Rejected if the namespace turns out to be tenant-wide."
+  ),
   // Lookup-mode args — provide `field` plus EXACTLY ONE of: value | from+to | prefix.
-  type: z19.string().optional().describe('Lookup mode: the identity schema\'s record type (e.g. "person_v1"). Required with `field`.'),
-  field: z19.string().optional().describe('Lookup mode: name of the schema-declared lookup field to query by (e.g. "email").'),
-  value: z19.string().optional().describe("Lookup mode (equality): exact-match value for `field`. Works on sensitive fields."),
-  from: z19.string().optional().describe("Lookup mode (range): inclusive lower bound; requires `to`. Non-sensitive fields only."),
-  to: z19.string().optional().describe("Lookup mode (range): inclusive upper bound; requires `from`."),
-  prefix: z19.string().optional().describe("Lookup mode (prefix): match values starting with this. Range-enabled string fields only."),
-  order: z19.enum(["asc", "desc"]).optional().describe("Lookup mode: sort direction by the looked-up field. `asc` (default) or `desc`."),
-  startFrom: z19.string().optional().describe("Lookup mode: pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next."),
-  limit: z19.number().int().min(1).max(MCP_MAX_LIMIT5).optional().describe(
+  type: z20.string().optional().describe('Lookup mode: the identity schema\'s record type (e.g. "person_v1"). Required with `field`.'),
+  field: z20.string().optional().describe('Lookup mode: name of the schema-declared lookup field to query by (e.g. "email").'),
+  value: z20.string().optional().describe("Lookup mode (equality): exact-match value for `field`. Works on sensitive fields."),
+  from: z20.string().optional().describe("Lookup mode (range): inclusive lower bound; requires `to`. Non-sensitive fields only."),
+  to: z20.string().optional().describe("Lookup mode (range): inclusive upper bound; requires `from`."),
+  prefix: z20.string().optional().describe("Lookup mode (prefix): match values starting with this. Range-enabled string fields only."),
+  order: z20.enum(["asc", "desc"]).optional().describe("Lookup mode: sort direction by the looked-up field. `asc` (default) or `desc`."),
+  startFrom: z20.string().optional().describe("Lookup mode: pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next."),
+  limit: z20.number().int().min(1).max(MCP_MAX_LIMIT5).optional().describe(
     `Max principals per page. Defaults to ${MCP_DEFAULT_LIMIT5}; raise up to ${MCP_MAX_LIMIT5} (the principals API max) in one call when you can accept the payload, or page with \`startFrom\`.`
   )
 };
 var lookupPrincipal = ({ client, log }) => ({
   name: "lookup_principal",
   title: "Look up a user identity or a namespaced identity entity",
-  description: "Resolve a user, or an identity entity in a namespace (org/client/one you registered). Two modes:\n  \u2022 Resolve by your own id: pass `externalId` \u2192 the matching principal incl. its Vectros UUID (the id the ownership filters on record_query / hybrid_search / rag_ask expect).\n  \u2022 Lookup by a schema field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Sensitive-field-safe. (If both `externalId` and a `field` lookup are given, `externalId` wins.) Returns a `{ data, nextCursor }` page (default 10, max 100 \u2014 raise it in one call when you can accept the payload); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom`. Read-only \u2014 does not create or modify identities.",
-  inputSchema: inputSchema20,
+  description: "Resolve a user, or an identity entity in a namespace (org/client/one you registered). Two modes:\n  \u2022 Resolve by your own id: pass `externalId` \u2192 the matching principal incl. its Vectros UUID (the id the ownership filters on record_query / hybrid_search / rag_ask expect).\n  \u2022 Lookup by a schema field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Sensitive-field-safe. (If both `externalId` and a `field` lookup are given, `externalId` wins.) For an entity kind, `contextId` names a specific app context when the namespace is context-owned rather than tenant-wide; a context-confined credential's own context is used automatically without it. Returns a `{ data, nextCursor }` page (default 10, max 100 \u2014 raise it in one call when you can accept the payload); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom`. Read-only \u2014 does not create or modify identities.",
+  inputSchema: inputSchema21,
   handler: async (args) => {
     const kind = args.kind;
     const isUser = kind === "user";
     const limit = args.limit ?? MCP_DEFAULT_LIMIT5;
     const externalId = args.externalId;
+    const contextId = args.contextId;
     const type = args.type;
     const field = args.field;
     const value = args.value;
@@ -10882,11 +11125,18 @@ var lookupPrincipal = ({ client, log }) => ({
     const prefix = args.prefix;
     const order = args.order;
     const startFrom = args.startFrom;
+    if (contextId !== void 0 && isUser) {
+      return toolError(
+        "lookup_principal",
+        new Error("'contextId' does not apply to kind 'user' \u2014 the user surface is always tenant-wide.")
+      );
+    }
+    const contextIdArg = contextId !== void 0 ? { contextId } : {};
     try {
       let page;
       if (externalId !== void 0) {
-        page = isUser ? await client.identity.listUsers({ externalId, limit }) : await client.identity.listEntities({ namespace: kind, externalId, limit });
-        log.debug({ tool: "lookup_principal", mode: "resolve", kind }, "lookup_principal resolve ok");
+        page = isUser ? await client.identity.listUsers({ externalId, limit }) : await client.identity.listEntities({ namespace: kind, ...contextIdArg, externalId, limit });
+        log.debug({ tool: "lookup_principal", mode: "resolve", kind, contextId }, "lookup_principal resolve ok");
       } else if (field !== void 0) {
         const hasEquality = value !== void 0;
         const hasRange = from !== void 0 || to !== void 0;
@@ -10914,8 +11164,8 @@ var lookupPrincipal = ({ client, log }) => ({
           );
         }
         const req = { type, field, value, from, to, prefix, order, startFrom, limit };
-        page = isUser ? await client.identity.lookupUsers(req) : await client.identity.lookupEntities({ namespace: kind, body: req });
-        log.debug({ tool: "lookup_principal", mode: "lookup", kind, type, field }, "lookup_principal lookup ok");
+        page = isUser ? await client.identity.lookupUsers(req) : await client.identity.lookupEntities({ namespace: kind, ...contextIdArg, body: req });
+        log.debug({ tool: "lookup_principal", mode: "lookup", kind, type, field, contextId }, "lookup_principal lookup ok");
       } else {
         return toolError(
           "lookup_principal",
@@ -10926,7 +11176,7 @@ var lookupPrincipal = ({ client, log }) => ({
       const nextCursor = page.nextCursor ?? null;
       return { content: [{ type: "text", text: JSON.stringify({ data: principals, nextCursor }, null, 2) }] };
     } catch (err) {
-      log.warn({ tool: "lookup_principal", kind, err: String(err) }, "lookup_principal failed");
+      log.warn({ tool: "lookup_principal", kind, contextId, err: String(err) }, "lookup_principal failed");
       return toolError("lookup_principal", err);
     }
   }
@@ -10934,17 +11184,17 @@ var lookupPrincipal = ({ client, log }) => ({
 var lookup_principal_default = lookupPrincipal;
 
 // src/tools/version_history.ts
-import { z as z20 } from "zod";
-var inputSchema21 = {
-  resourceType: z20.enum(["record", "document"]).describe("Which kind of entity the id refers to: a record or a document."),
-  id: z20.string().min(1, "id is required").describe("The Vectros id of the record or document whose history you want."),
-  startFrom: z20.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch older entries.")
+import { z as z21 } from "zod";
+var inputSchema22 = {
+  resourceType: z21.enum(["record", "document"]).describe("Which kind of entity the id refers to: a record or a document."),
+  id: z21.string().min(1, "id is required").describe("The Vectros id of the record or document whose history you want."),
+  startFrom: z21.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch older entries.")
 };
 var versionHistory = ({ client, log }) => ({
   name: "version_history",
   title: "Version history (record or document)",
   description: "Read the audit/version trail (CREATE/UPDATE/DELETE, with actor, timestamp, and diff) for a single record or document. Pass `resourceType` (record|document) and `id`. Returns `{ data, nextCursor }`; pass `nextCursor` back as `startFrom` to page through older entries. Entities without audit history (untyped) return an empty trail. Read-only.",
-  inputSchema: inputSchema21,
+  inputSchema: inputSchema22,
   handler: async (args) => {
     const resourceType = args.resourceType;
     const id = args.id;
@@ -10971,6 +11221,7 @@ var TOOL_NAMES = [
   "hybrid_search",
   "record_query",
   "record_get",
+  "record_batch_get",
   "record_create",
   "record_update",
   "record_delete",
@@ -10996,6 +11247,7 @@ var ALL_TOOL_FACTORIES = {
   hybrid_search: hybrid_search_default,
   record_query: record_query_default,
   record_get: record_get_default,
+  record_batch_get: record_batch_get_default,
   record_create: record_create_default,
   record_update: record_update_default,
   record_delete: record_delete_default,
@@ -11037,7 +11289,7 @@ var identityResource = ({ log, apiKey, environment }) => ({
   name: "identity",
   uri: "vectros://identity",
   title: "Current identity (tenant + principal scope)",
-  description: "The tenant + principal scope the MCP server is authenticated as. Returns the same payload as the `current_identity` tool: status, tenantId, environment, principalType, principalKeyId, principalLabel, (for scoped credentials) allowedActions + dataScope ({ userId, scopes[] }), plus mcpServerVersion and sdkVersion (this build's own version and the bundled @vectros-ai/sdk version). The /v1/ping backing call ships the extended shape today; the version fields are always client-derived.",
+  description: "The tenant + principal scope the MCP server is authenticated as. Returns the same payload as the `current_identity` tool: status, tenantId, environment, principalType, principalKeyId, principalLabel, (for scoped credentials) allowedActions + dataScope ({ userId, scopes[] }). Note: this does not yet include granted_capabilities (member-lifecycle / forensic-read / context-directory-read / delegate-mint) \u2014 a separate reach dimension a scope clause can carry as of API 0.40.0 that /v1/ping does not report yet, so allowedActions+dataScope may understate a credential's true reach. Also reports mcpServerVersion and sdkVersion (this build's own version and the bundled @vectros-ai/sdk version). The /v1/ping backing call ships the extended shape today; the version fields are always client-derived.",
   mimeType: "application/json",
   read: async () => {
     const identity = await resolveIdentity({ log, apiKey, environment });
@@ -11056,7 +11308,7 @@ var ALL_RESOURCE_FACTORIES = {
 };
 
 // src/zod-to-json-schema.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 function zodShapeToJsonSchema(shape) {
   const properties = {};
   const required = [];
@@ -11071,40 +11323,40 @@ function zodShapeToJsonSchema(shape) {
 function zodTypeToJsonSchema(schema) {
   const description = schema.description;
   let current = schema;
-  while (current instanceof z21.ZodOptional || current instanceof z21.ZodDefault || current instanceof z21.ZodNullable) {
+  while (current instanceof z22.ZodOptional || current instanceof z22.ZodDefault || current instanceof z22.ZodNullable) {
     current = current._def.innerType;
   }
   const base = description ? { description } : {};
-  if (current instanceof z21.ZodString) {
+  if (current instanceof z22.ZodString) {
     return { ...base, type: "string" };
   }
-  if (current instanceof z21.ZodNumber) {
+  if (current instanceof z22.ZodNumber) {
     return { ...base, type: "number" };
   }
-  if (current instanceof z21.ZodBoolean) {
+  if (current instanceof z22.ZodBoolean) {
     return { ...base, type: "boolean" };
   }
-  if (current instanceof z21.ZodEnum) {
+  if (current instanceof z22.ZodEnum) {
     return {
       ...base,
       type: "string",
       enum: current.options
     };
   }
-  if (current instanceof z21.ZodArray) {
+  if (current instanceof z22.ZodArray) {
     return {
       ...base,
       type: "array",
       items: zodTypeToJsonSchema(current.element)
     };
   }
-  if (current instanceof z21.ZodObject) {
+  if (current instanceof z22.ZodObject) {
     return {
       ...base,
       ...zodShapeToJsonSchema(current.shape)
     };
   }
-  if (current instanceof z21.ZodRecord) {
+  if (current instanceof z22.ZodRecord) {
     const valueType = current._def.valueType;
     return {
       ...base,
@@ -11228,7 +11480,7 @@ var VectrosMCPServer = class {
       if (!tool) {
         result = toolError(req.params.name ?? "unknown", new Error("No such tool."));
       } else {
-        const parsed = z22.object(tool.inputSchema).strict().safeParse(req.params.arguments ?? {});
+        const parsed = z23.object(tool.inputSchema).strict().safeParse(req.params.arguments ?? {});
         if (!parsed.success) {
           result = toolError(tool.name, new Error(formatArgError(tool, parsed.error)));
         } else {