@vectros-ai/mcp-server 0.7.0 → 0.10.0

package/dist/cli-http.mjs

@@ -3,7 +3,7 @@
 // src/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 
-// ../../node_modules/@vectros-ai/sdk/dist/index.mjs
+// node_modules/@vectros-ai/sdk/dist/index.mjs
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -18,7 +18,6 @@ __export(api_exports, {
   BatchWriteRequest: () => BatchWriteRequest,
   BatchWriteResult: () => BatchWriteResult,
   ChatMessage: () => ChatMessage,
-  ClientRequest: () => ClientRequest,
   ConflictError: () => ConflictError,
   ContentDeltaEvent: () => ContentDeltaEvent,
   ContentTooLargeError: () => ContentTooLargeError,
@@ -27,6 +26,7 @@ __export(api_exports, {
   DocumentRequest: () => DocumentRequest,
   DocumentResponse: () => DocumentResponse,
   DoneEvent: () => DoneEvent,
+  EntityRequest: () => EntityRequest,
   ErasureCertificate: () => ErasureCertificate,
   ErasureRequest: () => ErasureRequest,
   ErasureRequestResponse: () => ErasureRequestResponse,
@@ -39,15 +39,13 @@ __export(api_exports, {
   ForbiddenError: () => ForbiddenError,
   IdentityLookupRequest: () => IdentityLookupRequest,
   InternalServerError: () => InternalServerError,
-  ListClientsRequestOrder: () => ListClientsRequestOrder,
-  ListOrgsRequestOrder: () => ListOrgsRequestOrder,
+  ListEntitiesRequestOrder: () => ListEntitiesRequestOrder,
   ListUsersRequestOrder: () => ListUsersRequestOrder,
   LookupDocumentsRequestOrder: () => LookupDocumentsRequestOrder,
   LookupRecordsRequestOrder: () => LookupRecordsRequestOrder,
   ModelDataVersionResponse: () => ModelDataVersionResponse,
   NotFoundError: () => NotFoundError,
   NotImplementedError: () => NotImplementedError,
-  OrgRequest: () => OrgRequest,
   PaymentRequiredError: () => PaymentRequiredError,
   PingResponse: () => PingResponse,
   RagSearch: () => RagSearch,
@@ -288,11 +286,6 @@ var UnauthorizedError = class extends VectrosError {
 var auth_exports = {};
 var ErasureRequest;
 ((ErasureRequest2) => {
-  ErasureRequest2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
   ErasureRequest2.AuditDisposition = {
     RetainRedacted: "retain-redacted",
     Purge: "purge"
@@ -304,11 +297,6 @@ var ExportRequest;
     Tenant: "tenant",
     Subject: "subject"
   };
-  ExportRequest2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
   ExportRequest2.Format = {
     Ndjson: "ndjson"
   };
@@ -347,15 +335,10 @@ var LookupDocumentsRequestOrder = {
 var folders_exports = {};
 var identity_exports = {};
 __export(identity_exports, {
-  ListClientsRequestOrder: () => ListClientsRequestOrder,
-  ListOrgsRequestOrder: () => ListOrgsRequestOrder,
+  ListEntitiesRequestOrder: () => ListEntitiesRequestOrder,
   ListUsersRequestOrder: () => ListUsersRequestOrder
 });
-var ListClientsRequestOrder = {
-  Asc: "asc",
-  Desc: "desc"
-};
-var ListOrgsRequestOrder = {
+var ListEntitiesRequestOrder = {
   Asc: "asc",
   Desc: "desc"
 };
@@ -454,13 +437,6 @@ var ChatMessage;
     Assistant: "assistant"
   };
 })(ChatMessage || (ChatMessage = {}));
-var ClientRequest;
-((ClientRequest2) => {
-  ClientRequest2.Status = {
-    Active: "ACTIVE",
-    Suspended: "SUSPENDED"
-  };
-})(ClientRequest || (ClientRequest = {}));
 var ContentDeltaEvent;
 ((ContentDeltaEvent2) => {
   ContentDeltaEvent2.Event = {
@@ -515,6 +491,13 @@ var DoneEvent;
     Done: "done"
   };
 })(DoneEvent || (DoneEvent = {}));
+var EntityRequest;
+((EntityRequest2) => {
+  EntityRequest2.Status = {
+    Active: "ACTIVE",
+    Suspended: "SUSPENDED"
+  };
+})(EntityRequest || (EntityRequest = {}));
 var ErasureCertificate;
 ((ErasureCertificate2) => {
   ErasureCertificate2.AuditDisposition = {
@@ -530,11 +513,6 @@ var ErasureRequestResponse;
     Completed: "completed",
     Failed: "failed"
   };
-  ErasureRequestResponse2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
 })(ErasureRequestResponse || (ErasureRequestResponse = {}));
 var ErrorEvent;
 ((ErrorEvent2) => {
@@ -560,11 +538,6 @@ var ExportRequestResponse;
     Tenant: "tenant",
     Subject: "subject"
   };
-  ExportRequestResponse2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
 })(ExportRequestResponse || (ExportRequestResponse = {}));
 var FieldDef;
 ((FieldDef2) => {
@@ -578,13 +551,6 @@ var FieldDef;
     Object: "object",
     Reference: "reference"
   };
-  FieldDef2.TargetSurface = {
-    Record: "record",
-    Document: "document",
-    User: "user",
-    Org: "org",
-    Client: "client"
-  };
 })(FieldDef || (FieldDef = {}));
 var IdentityLookupRequest;
 ((IdentityLookupRequest2) => {
@@ -601,13 +567,6 @@ var ModelDataVersionResponse;
     Delete: "DELETE"
   };
 })(ModelDataVersionResponse || (ModelDataVersionResponse = {}));
-var OrgRequest;
-((OrgRequest2) => {
-  OrgRequest2.Status = {
-    Active: "ACTIVE",
-    Suspended: "SUSPENDED"
-  };
-})(OrgRequest || (OrgRequest = {}));
 var PingResponse;
 ((PingResponse2) => {
   PingResponse2.Environment = {
@@ -637,11 +596,6 @@ var RagSearch;
 })(RagSearch || (RagSearch = {}));
 var ReadAccessLogResponse;
 ((ReadAccessLogResponse2) => {
-  ReadAccessLogResponse2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
   ReadAccessLogResponse2.Action = {
     Read: "read",
     List: "list",
@@ -652,6 +606,10 @@ var ReadAccessLogResponse;
 })(ReadAccessLogResponse || (ReadAccessLogResponse = {}));
 var RecordRequest;
 ((RecordRequest2) => {
+  RecordRequest2.Status = {
+    Active: "ACTIVE",
+    Archived: "ARCHIVED"
+  };
   RecordRequest2.IndexMode = {
     Hybrid: "HYBRID",
     Semantic: "SEMANTIC",
@@ -661,6 +619,10 @@ var RecordRequest;
 })(RecordRequest || (RecordRequest = {}));
 var RecordResponse;
 ((RecordResponse2) => {
+  RecordResponse2.Status = {
+    Active: "ACTIVE",
+    Archived: "ARCHIVED"
+  };
   RecordResponse2.IndexStatus = {
     PendingIndex: "PENDING_INDEX",
     Indexed: "INDEXED",
@@ -703,8 +665,7 @@ var SchemaRequest;
       Record: "record",
       Document: "document",
       User: "user",
-      Org: "org",
-      Client: "client"
+      Entity: "entity"
     };
   })(AllowedSurfaces = SchemaRequest2.AllowedSurfaces || (SchemaRequest2.AllowedSurfaces = {}));
 })(SchemaRequest || (SchemaRequest = {}));
@@ -727,8 +688,7 @@ var SchemaResponse;
       Record: "record",
       Document: "document",
       User: "user",
-      Org: "org",
-      Client: "client"
+      Entity: "entity"
     };
   })(AllowedSurfaces = SchemaResponse2.AllowedSurfaces || (SchemaResponse2.AllowedSurfaces = {}));
 })(SchemaResponse || (SchemaResponse = {}));
@@ -2283,7 +2243,7 @@ function withNoOpAuthProvider(options) {
     authProvider: new NoOpAuthProvider()
   };
 }
-function handleNonStatusCodeError(error, rawResponse, method, path) {
+function handleNonStatusCodeError(error, rawResponse, method, path2) {
   switch (error.reason) {
     case "non-json":
       throw new VectrosError({
@@ -2297,7 +2257,7 @@ function handleNonStatusCodeError(error, rawResponse, method, path) {
         rawResponse
       });
     case "timeout":
-      throw new VectrosTimeoutError(`Timeout exceeded when calling ${method} ${path}.`, {
+      throw new VectrosTimeoutError(`Timeout exceeded when calling ${method} ${path2}.`, {
         cause: error.cause
       });
     case "unknown":
@@ -2369,7 +2329,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/jwks");
   }
   /**
-   * Returns a page of per-subject PHI read-access rows: who read which subject's PHI, when, against which record, and whether any sensitive value was actually revealed in plaintext. Metadata only — never the PHI itself. This is the disclosure-accounting surface from which a covered entity derives its HIPAA §164.528 accounting of disclosures. Provide at least one query axis: a subject (`subjectType` + `subjectId`, plus optional `clientId`) within a `contextId` for the primary accounting query; `resourceId` within a `contextId` for 'who read this record'; `callerKeyId` for 'what did this credential read' (account-wide forensic); or `contextId` alone to enumerate a whole context. `from`/`to` bound the time window. Results are scoped to your account, derived from your token — never from input. Requires the `access-log:r` scope.
+   * Returns a page of per-subject PHI read-access rows: who read which subject's PHI, when, against which record, and whether any sensitive value was actually revealed in plaintext. Metadata only — never the PHI itself. This is the disclosure-accounting surface from which a covered entity derives its HIPAA §164.528 accounting of disclosures. Provide at least one query axis: a subject (`subjectType` + `subjectId`) within a `contextId` for the primary accounting query; `resourceId` within a `contextId` for 'who read this record'; `callerKeyId` for 'what did this credential read' (account-wide forensic); or `contextId` alone to enumerate a whole context. `from`/`to` bound the time window. Results are scoped to your account, derived from your token — never from input. Requires the `access-log:r` scope.
    *
    * @param {Vectros.GetAccessLogRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -2382,7 +2342,6 @@ var AuthClient = class {
    *         subjectType: "user",
    *         subjectId: "user_abc123",
    *         contextId: "ctx_intake",
-   *         clientId: "client_xyz789",
    *         action: "read",
    *         callerKeyId: "key_abc123",
    *         resourceType: "intake_form",
@@ -2397,7 +2356,6 @@ var AuthClient = class {
       subjectType,
       subjectId,
       contextId,
-      clientId,
       from: from_,
       to,
       action,
@@ -2412,7 +2370,6 @@ var AuthClient = class {
       subjectType,
       subjectId,
       contextId,
-      clientId,
       from: from_,
       to,
       action,
@@ -2846,7 +2803,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope). You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` may set only `orgId` and `clientId`; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
+   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope). You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
    *
    * @param {Vectros.CreateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -3135,7 +3092,7 @@ var AuthClient = class {
    *             roleId: "engineering-member",
    *             name: "Engineering Team Member",
    *             scopes: [{
-   *                     allowed_actions: ["read", "write"]
+   *                     allowed_actions: ["records:cru", "search:r"]
    *                 }]
    *         }
    *     })
@@ -3683,7 +3640,7 @@ var AuthClient = class {
    *             roleId: "engineering-member",
    *             name: "Engineering Team Member",
    *             scopes: [{
-   *                     allowed_actions: ["read", "write"]
+   *                     allowed_actions: ["records:cru", "search:r"]
    *                 }]
    *         }
    *     })
@@ -4136,7 +4093,7 @@ var AuthClient = class {
    *                 "userId": "550e8400-e29b-41d4-a716-446655440000"
    *             },
    *             dataScope: {
-   *                 "orgId": ["6ba7b810-9dad-11d1-80b4-00c04fd430c8"]
+   *                 "scope:org": ["6ba7b810-9dad-11d1-80b4-00c04fd430c8"]
    *             }
    *         },
    *         expiresInSeconds: 3600
@@ -4586,7 +4543,7 @@ var DocumentsClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of your documents, optionally filtered by folder (`folderId`) and/or owner (`userId`, `orgId`, or `clientId`). The response is a `{data, nextCursor}` envelope; pass `nextCursor` back as `startFrom` to fetch the next page. Requires the `documents:r` scope.
+   * Returns a paginated list of your documents, optionally filtered by folder (`folderId`) and/or owner (`userId` or `scope`). The response is a `{data, nextCursor}` envelope; pass `nextCursor` back as `startFrom` to fetch the next page. Requires the `documents:r` scope.
    *
    * @param {Vectros.ListDocumentsRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4594,8 +4551,7 @@ var DocumentsClient = class {
    * @example
    *     await client.documents.listDocuments({
    *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-   *         clientId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
+   *         scope: "group:eng-team",
    *         folderId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    *         startFrom: "doc_prev123"
    *     })
@@ -4604,11 +4560,10 @@ var DocumentsClient = class {
     return HttpResponsePromise.fromPromise(this.__listDocuments(request, requestOptions));
   }
   async __listDocuments(request = {}, requestOptions) {
-    const { userId, orgId, clientId, folderId, startFrom, limit } = request;
+    const { userId, scope, folderId, startFrom, limit } = request;
     const _queryParams = {
       userId,
-      orgId,
-      clientId,
+      scope,
       folderId,
       startFrom,
       limit
@@ -4666,9 +4621,10 @@ var DocumentsClient = class {
     return HttpResponsePromise.fromPromise(this.__ingestDocument(request, requestOptions));
   }
   async __ingestDocument(request, requestOptions) {
-    const { upsert, body: _body } = request;
+    const { upsert, allowClear, body: _body } = request;
     const _queryParams = {
-      upsert
+      upsert,
+      allowClear
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -4792,7 +4748,10 @@ var DocumentsClient = class {
     return HttpResponsePromise.fromPromise(this.__updateDocument(request, requestOptions));
   }
   async __updateDocument(request, requestOptions) {
-    const { id, body: _body } = request;
+    const { id, allowClear, body: _body } = request;
+    const _queryParams = {
+      allowClear
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -4807,7 +4766,7 @@ var DocumentsClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -5336,7 +5295,7 @@ var FoldersClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of your folders. Pass `parentFolderId` to list the direct children of a specific folder (tree navigation); omit it for a flat list across your account. You can also filter by owner using `userId`, `orgId`, or `clientId`. Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `folders:r` scope.
+   * Returns a paginated list of your folders. Pass `parentFolderId` to list the direct children of a specific folder (tree navigation); omit it for a flat list across your account. You can also filter by owner using `userId` or `scope`. Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `folders:r` scope.
    *
    * @param {Vectros.ListFoldersRequest} request
    * @param {FoldersClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5344,9 +5303,8 @@ var FoldersClient = class {
    * @example
    *     await client.folders.listFolders({
    *         parentFolderId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         clientId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
+   *         scope: "group:eng-team",
    *         startFrom: "fld_prev123"
    *     })
    */
@@ -5354,12 +5312,11 @@ var FoldersClient = class {
     return HttpResponsePromise.fromPromise(this.__listFolders(request, requestOptions));
   }
   async __listFolders(request = {}, requestOptions) {
-    const { parentFolderId, orgId, userId, clientId, startFrom, limit } = request;
+    const { parentFolderId, userId, scope, startFrom, limit } = request;
     const _queryParams = {
       parentFolderId,
-      orgId,
       userId,
-      clientId,
+      scope,
       startFrom,
       limit
     };
@@ -5645,7 +5602,7 @@ var FoldersClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/folders/{id}");
   }
   /**
-   * Partially updates a folder using an RFC 7386 JSON Merge Patch. The `name`, `description`, and ownership fields (`userId`, `orgId`, `clientId`) are applied when present and left unchanged when omitted; sending any of these as null is rejected, because clearing a field is not supported in this release (omit it instead). `slug` and `parentFolderId` are immutable — a folder cannot be re-slugged or moved via the API — and the request is rejected if either is present. Pass `expectedVersion` for optimistic concurrency (you get a 409 if the folder changed since you last read it). Requires the `folders:u` scope.
+   * Partially updates a folder using an RFC 7386 JSON Merge Patch. The `name`, `description`, and ownership fields (`userId`, `scopes`) are applied when present and left unchanged when omitted; sending any of these as null is rejected, because clearing a field is not supported in this release (omit it instead). `slug` and `parentFolderId` are immutable — a folder cannot be re-slugged or moved via the API — and the request is rejected if either is present. Pass `expectedVersion` for optimistic concurrency (you get a 409 if the folder changed since you last read it). Requires the `folders:u` scope.
    *
    * @param {Vectros.PatchFolderRequest} request
    * @param {FoldersClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5778,54 +5735,48 @@ var IdentityClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of clients in your account. Narrow the results with `orgId` or `userId`, or use `externalId` for an exact lookup by your own identifier. For schema-bound clients, you can also query by a schema-declared lookup field using `type`, `field`, and one lookup mode (`value` for equality, `from`/`to` for a range, or `prefix`). The response is a `{data, nextCursor}` envelope; pass `nextCursor` back as `startFrom` to fetch the next page. Requires the `clients:r` scope.
+   * Returns a paginated list of entities in a namespace. Filter by `userId` (entities owned by a user), by `externalId` (exact lookup by your own identifier), or by `scope` (`scope=<namespace>:<value>` — entities that have that value as a parent, e.g. `scope=org:6ba7...`). Naming this namespace's own name in `scope` resolves the entity itself (`scope=team:6ba7...` on `/v1/entities/team` returns that team), since an entity is always in its own scope. `userId` and `scope` can be combined to narrow on both dimensions at once; `externalId` identifies a single entity and cannot be combined with either. Requires the `entities:r:<namespace>` scope.
    *
-   * @param {Vectros.ListClientsRequest} request
+   * @param {Vectros.ListEntitiesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @example
-   *     await client.identity.listClients({
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-   *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         externalId: "patient_789",
-   *         startFrom: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
-   *         type: "client_v1",
-   *         field: "industry",
-   *         value: "healthcare",
-   *         prefix: "health"
+   *     await client.identity.listEntities({
+   *         namespace: "team"
    *     })
    */
-  listClients(request = {}, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__listClients(request, requestOptions));
+  listEntities(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listEntities(request, requestOptions));
   }
-  async __listClients(request = {}, requestOptions) {
+  async __listEntities(request, requestOptions) {
     const {
-      orgId,
+      namespace,
       userId,
       externalId,
-      startFrom,
-      limit,
+      scope,
       type: type_,
       field,
       value,
       from: from_,
       to,
       prefix,
-      order
+      order,
+      startFrom,
+      limit
     } = request;
     const _queryParams = {
-      orgId,
       userId,
       externalId,
-      startFrom,
-      limit,
+      scope,
       type: type_,
       field,
       value,
       from: from_,
       to,
       prefix,
-      order: order != null ? order : void 0
+      order: order != null ? order : void 0,
+      startFrom,
+      limit
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -5836,7 +5787,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/clients"
+        `v1/entities/${url_exports.encodePathParam(namespace)}`
       ),
       method: "GET",
       headers: _headers,
@@ -5857,12 +5808,12 @@ var IdentityClient = class {
         rawResponse: _response.rawResponse
       });
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/clients");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/entities/{namespace}");
   }
   /**
-   * Creates a new client identity in your account. This call is idempotent on `externalId`: if a client with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing client was returned) tells the two apart. To overwrite an existing client's content instead of returning it unchanged, set `?upsert=true` (this also requires the `clients:u` scope). Requires the `clients:c` scope.
+   * Creates a new entity in the given namespace. This call is idempotent on `externalId` within the namespace: if an entity with the same `externalId` already exists, the existing record is returned instead of creating a duplicate (`created: false`, HTTP 200). To overwrite an existing entity's content instead of returning it unchanged, set `?upsert=true` (also requires the `entities:u:<namespace>` scope). The namespace must be entity-backed (`org`/`client`, or registered via `POST /v1/namespaces`). Requires the `entities:c:<namespace>` scope.
    *
-   * @param {Vectros.CreateClientRequest} request
+   * @param {Vectros.CreateEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
@@ -5870,17 +5821,18 @@ var IdentityClient = class {
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.createClient({
+   *     await client.identity.createEntity({
+   *         namespace: "team",
    *         body: {
-   *             externalId: "patient_789"
+   *             externalId: "team_eng_platform"
    *         }
    *     })
    */
-  createClient(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__createClient(request, requestOptions));
+  createEntity(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__createEntity(request, requestOptions));
   }
-  async __createClient(request, requestOptions) {
-    const { upsert, body: _body } = request;
+  async __createEntity(request, requestOptions) {
+    const { namespace, upsert, body: _body } = request;
     const _queryParams = {
       upsert
     };
@@ -5893,7 +5845,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/clients"
+        `v1/entities/${url_exports.encodePathParam(namespace)}`
       ),
       method: "POST",
       headers: _headers,
@@ -5926,26 +5878,27 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/clients");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/entities/{namespace}");
   }
   /**
-   * Returns a single client by its Vectros-assigned UUID. Requires the `clients:r` scope.
+   * Retrieves a single entity by its namespace and Vectros-assigned ID. Requires the `entities:r:<namespace>` scope.
    *
-   * @param {Vectros.GetClientRequest} request
+   * @param {Vectros.GetEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    *
    * @example
-   *     await client.identity.getClient({
-   *         id: "f47ac10b-58cc-4372-a567-0e02b2c3d479"
+   *     await client.identity.getEntity({
+   *         namespace: "team",
+   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
    *     })
    */
-  getClient(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__getClient(request, requestOptions));
+  getEntity(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getEntity(request, requestOptions));
   }
-  async __getClient(request, requestOptions) {
-    const { id } = request;
+  async __getEntity(request, requestOptions) {
+    const { namespace, id } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -5955,7 +5908,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/clients/${url_exports.encodePathParam(id)}`
+        `v1/entities/${url_exports.encodePathParam(namespace)}/${url_exports.encodePathParam(id)}`
       ),
       method: "GET",
       headers: _headers,
@@ -5981,30 +5934,31 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/clients/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/entities/{namespace}/{id}");
   }
   /**
-   * Updates mutable fields on an existing client. Omitted fields are preserved (a null does not clear a field); when `payload` is supplied it replaces the stored payload in full rather than being deep-merged. Requires the `clients:u` scope.
+   * Updates the mutable fields of an entity. Omitted fields are preserved (a null value does not clear a field), and the `payload` object is replaced in full when supplied. Providing `scopes` replaces the entity's parent edges. Requires the `entities:u:<namespace>` scope.
    *
-   * @param {Vectros.UpdateClientRequest} request
+   * @param {Vectros.UpdateEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.updateClient({
+   *     await client.identity.updateEntity({
+   *         namespace: "team",
    *         id: "id",
    *         body: {
-   *             externalId: "patient_789"
+   *             externalId: "team_eng_platform"
    *         }
    *     })
    */
-  updateClient(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__updateClient(request, requestOptions));
+  updateEntity(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateEntity(request, requestOptions));
   }
-  async __updateClient(request, requestOptions) {
-    const { id, body: _body } = request;
+  async __updateEntity(request, requestOptions) {
+    const { namespace, id, body: _body } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6014,7 +5968,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/clients/${url_exports.encodePathParam(id)}`
+        `v1/entities/${url_exports.encodePathParam(namespace)}/${url_exports.encodePathParam(id)}`
       ),
       method: "PUT",
       headers: _headers,
@@ -6045,27 +5999,28 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/clients/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/entities/{namespace}/{id}");
   }
   /**
-   * Permanently deletes the client. This action cannot be undone. Requires the `clients:d` scope.
+   * Permanently deletes an entity. This action cannot be undone. Requires the `entities:d:<namespace>` scope.
    *
-   * @param {Vectros.DeleteClientRequest} request
+   * @param {Vectros.DeleteEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.deleteClient({
+   *     await client.identity.deleteEntity({
+   *         namespace: "team",
    *         id: "id"
    *     })
    */
-  deleteClient(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__deleteClient(request, requestOptions));
+  deleteEntity(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteEntity(request, requestOptions));
   }
-  async __deleteClient(request, requestOptions) {
-    const { id } = request;
+  async __deleteEntity(request, requestOptions) {
+    const { namespace, id } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6075,7 +6030,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/clients/${url_exports.encodePathParam(id)}`
+        `v1/entities/${url_exports.encodePathParam(namespace)}/${url_exports.encodePathParam(id)}`
       ),
       method: "DELETE",
       headers: _headers,
@@ -6103,27 +6058,36 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/clients/{id}");
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "DELETE",
+      "/v1/entities/{namespace}/{id}"
+    );
   }
   /**
-   * Body-based equivalent of the `type`/`field`/`value` lookup on `GET /v1/clients`. Use this when looking up by a sensitive (blind-indexed) field: the value travels in the request body rather than the URL. The `GET` list rejects a sensitive field's value and directs you here. The response is a `{data, nextCursor}` envelope. Requires the `clients:r` scope.
+   * Looks up entities in a namespace by a schema-declared field value, with the criteria in the request body instead of the URL. Use this for a sensitive field: the value travels in the body and never appears in the URL. Body equivalent of the `type`/`field`/`value` lookup on `GET /v1/entities/{namespace}`, which rejects sensitive-field values and directs you here. Requires the `entities:r:<namespace>` scope.
    *
-   * @param {Vectros.IdentityLookupRequest} request
+   * @param {Vectros.LookupEntitiesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.lookupClients({
-   *         type: "person_v1",
-   *         field: "ssn"
+   *     await client.identity.lookupEntities({
+   *         namespace: "team",
+   *         body: {
+   *             type: "person_v1",
+   *             field: "ssn"
+   *         }
    *     })
    */
-  lookupClients(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__lookupClients(request, requestOptions));
+  lookupEntities(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__lookupEntities(request, requestOptions));
   }
-  async __lookupClients(request, requestOptions) {
+  async __lookupEntities(request, requestOptions) {
+    const { namespace, body: _body } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6133,14 +6097,14 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/clients/lookup"
+        `v1/entities/${url_exports.encodePathParam(namespace)}/lookup`
       ),
       method: "POST",
       headers: _headers,
       contentType: "application/json",
       queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
-      body: request,
+      body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6164,26 +6128,32 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/clients/lookup");
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "POST",
+      "/v1/entities/{namespace}/lookup"
+    );
   }
   /**
-   * Returns the audit trail of changes to a client, newest first. Identity auditing is always on, so this history is always available; sensitive field values are redacted in each version. The response is a `{data, nextCursor}` envelope. Requires the `clients:r` scope.
+   * Returns the audit trail of changes made to an entity, newest first. Sensitive field values are redacted in the history. Requires the `entities:r:<namespace>` scope.
    *
-   * @param {Vectros.GetClientVersionsRequest} request
+   * @param {Vectros.GetEntityVersionsRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    *
    * @example
-   *     await client.identity.getClientVersions({
+   *     await client.identity.getEntityVersions({
+   *         namespace: "team",
    *         id: "id"
    *     })
    */
-  getClientVersions(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__getClientVersions(request, requestOptions));
+  getEntityVersions(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getEntityVersions(request, requestOptions));
   }
-  async __getClientVersions(request, requestOptions) {
-    const { id, startFrom } = request;
+  async __getEntityVersions(request, requestOptions) {
+    const { namespace, id, startFrom } = request;
     const _queryParams = {
       startFrom
     };
@@ -6196,7 +6166,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/clients/${url_exports.encodePathParam(id)}/versions`
+        `v1/entities/${url_exports.encodePathParam(namespace)}/${url_exports.encodePathParam(id)}/versions`
       ),
       method: "GET",
       headers: _headers,
@@ -6222,174 +6192,31 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/clients/{id}/versions");
-  }
-  /**
-   * Returns a paginated list of organizations in your account. Filter by `userId` to return only the organizations owned by a specific user, or by `externalId` for an exact lookup using your own identifier. You can also query schema-declared lookup fields by supplying `type` and `field` together with one lookup mode (`value` for equality, `from`/`to` for a range, or `prefix`). Requires the `orgs:r` scope.
-   *
-   * @param {Vectros.ListOrgsRequest} request
-   * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
-   *
-   * @example
-   *     await client.identity.listOrgs({
-   *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         externalId: "clinic_001",
-   *         startFrom: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-   *         type: "org_v1",
-   *         field: "region",
-   *         value: "us-east",
-   *         prefix: "us-"
-   *     })
-   */
-  listOrgs(request = {}, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__listOrgs(request, requestOptions));
-  }
-  async __listOrgs(request = {}, requestOptions) {
-    const {
-      userId,
-      externalId,
-      startFrom,
-      limit,
-      type: type_,
-      field,
-      value,
-      from: from_,
-      to,
-      prefix,
-      order
-    } = request;
-    const _queryParams = {
-      userId,
-      externalId,
-      startFrom,
-      limit,
-      type: type_,
-      field,
-      value,
-      from: from_,
-      to,
-      prefix,
-      order: order != null ? order : void 0
-    };
-    const _authRequest = await this._options.authProvider.getAuthRequest();
-    const _headers = mergeHeaders(
-      _authRequest.headers,
-      this._options?.headers,
-      requestOptions?.headers
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "GET",
+      "/v1/entities/{namespace}/{id}/versions"
     );
-    const _response = await fetcher({
-      url: url_exports.join(
-        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/orgs"
-      ),
-      method: "GET",
-      headers: _headers,
-      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
-      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
-      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
-      abortSignal: requestOptions?.abortSignal,
-      fetchFn: this._options?.fetch,
-      logging: this._options.logging
-    });
-    if (_response.ok) {
-      return { data: _response.body, rawResponse: _response.rawResponse };
-    }
-    if (_response.error.reason === "status-code") {
-      throw new VectrosError({
-        statusCode: _response.error.statusCode,
-        body: _response.error.body,
-        rawResponse: _response.rawResponse
-      });
-    }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/orgs");
   }
   /**
-   * Creates a new organization in your account. This call is idempotent on `externalId`: if an organization with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing organization was returned) tells the two apart. To overwrite an existing organization's content instead of returning it unchanged, set `?upsert=true` (this also requires the `orgs:u` scope). Requires the `orgs:c` scope.
+   * Retrieves a single scope-namespace registration by name. The reserved built-ins `org` and `client` are always resolvable.
    *
-   * @param {Vectros.CreateOrgRequest} request
-   * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
-   *
-   * @throws {@link Vectros.BadRequestError}
-   * @throws {@link Vectros.ForbiddenError}
-   * @throws {@link Vectros.TooManyRequestsError}
-   *
-   * @example
-   *     await client.identity.createOrg({
-   *         body: {
-   *             externalId: "clinic_001"
-   *         }
-   *     })
-   */
-  createOrg(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__createOrg(request, requestOptions));
-  }
-  async __createOrg(request, requestOptions) {
-    const { upsert, body: _body } = request;
-    const _queryParams = {
-      upsert
-    };
-    const _authRequest = await this._options.authProvider.getAuthRequest();
-    const _headers = mergeHeaders(
-      _authRequest.headers,
-      this._options?.headers,
-      requestOptions?.headers
-    );
-    const _response = await fetcher({
-      url: url_exports.join(
-        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/orgs"
-      ),
-      method: "POST",
-      headers: _headers,
-      contentType: "application/json",
-      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
-      requestType: "json",
-      body: _body,
-      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
-      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
-      abortSignal: requestOptions?.abortSignal,
-      fetchFn: this._options?.fetch,
-      logging: this._options.logging
-    });
-    if (_response.ok) {
-      return { data: _response.body, rawResponse: _response.rawResponse };
-    }
-    if (_response.error.reason === "status-code") {
-      switch (_response.error.statusCode) {
-        case 400:
-          throw new BadRequestError(_response.error.body, _response.rawResponse);
-        case 403:
-          throw new ForbiddenError(_response.error.body, _response.rawResponse);
-        case 429:
-          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        default:
-          throw new VectrosError({
-            statusCode: _response.error.statusCode,
-            body: _response.error.body,
-            rawResponse: _response.rawResponse
-          });
-      }
-    }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/orgs");
-  }
-  /**
-   * Retrieves a single organization by its Vectros-assigned ID, returning its current name, status, payload, and schema binding. Requires the `orgs:r` scope.
-   *
-   * @param {Vectros.GetOrgRequest} request
+   * @param {Vectros.GetNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    *
    * @example
-   *     await client.identity.getOrg({
-   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+   *     await client.identity.getNamespace({
+   *         namespace: "team"
    *     })
    */
-  getOrg(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__getOrg(request, requestOptions));
+  getNamespace(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getNamespace(request, requestOptions));
   }
-  async __getOrg(request, requestOptions) {
-    const { id } = request;
+  async __getNamespace(request, requestOptions) {
+    const { namespace } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6399,7 +6226,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/orgs/${url_exports.encodePathParam(id)}`
+        `v1/namespaces/${url_exports.encodePathParam(namespace)}`
       ),
       method: "GET",
       headers: _headers,
@@ -6425,30 +6252,31 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/orgs/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces/{namespace}");
   }
   /**
-   * Updates the mutable fields of an organization. Omitted fields are preserved (a null value does not clear a field), and the `payload` object is replaced in full when supplied rather than deep-merged. Requires the `orgs:u` scope.
+   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`) of a registered namespace. The namespace name itself is immutable. Requires a root API key. The reserved built-ins cannot be updated.
    *
-   * @param {Vectros.UpdateOrgRequest} request
+   * @param {Vectros.UpdateNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.updateOrg({
-   *         id: "id",
+   *     await client.identity.updateNamespace({
+   *         namespace: "team",
    *         body: {
-   *             externalId: "clinic_001"
+   *             namespace: "team"
    *         }
    *     })
    */
-  updateOrg(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__updateOrg(request, requestOptions));
+  updateNamespace(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateNamespace(request, requestOptions));
   }
-  async __updateOrg(request, requestOptions) {
-    const { id, body: _body } = request;
+  async __updateNamespace(request, requestOptions) {
+    const { namespace, body: _body } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6458,7 +6286,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/orgs/${url_exports.encodePathParam(id)}`
+        `v1/namespaces/${url_exports.encodePathParam(namespace)}`
       ),
       method: "PUT",
       headers: _headers,
@@ -6477,6 +6305,8 @@ var IdentityClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
@@ -6489,27 +6319,28 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/orgs/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/namespaces/{namespace}");
   }
   /**
-   * Permanently deletes an organization. This action cannot be undone. Requires the `orgs:d` scope.
+   * Deletes a registered scope namespace. Requires a root API key. The reserved built-ins cannot be deleted. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
    *
-   * @param {Vectros.DeleteOrgRequest} request
+   * @param {Vectros.DeleteNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.deleteOrg({
-   *         id: "id"
+   *     await client.identity.deleteNamespace({
+   *         namespace: "team"
    *     })
    */
-  deleteOrg(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__deleteOrg(request, requestOptions));
+  deleteNamespace(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteNamespace(request, requestOptions));
   }
-  async __deleteOrg(request, requestOptions) {
-    const { id } = request;
+  async __deleteNamespace(request, requestOptions) {
+    const { namespace } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6519,7 +6350,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/orgs/${url_exports.encodePathParam(id)}`
+        `v1/namespaces/${url_exports.encodePathParam(namespace)}`
       ),
       method: "DELETE",
       headers: _headers,
@@ -6535,6 +6366,8 @@ var IdentityClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
@@ -6547,27 +6380,26 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/orgs/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/namespaces/{namespace}");
   }
   /**
-   * Looks up organizations by a schema-declared field value, with the search criteria sent in the request body instead of the URL. Use this when looking up by a sensitive field: the value travels in the body and is never exposed in the URL. This is the body-based equivalent of the `type`/`field`/`value` lookup on `GET /v1/orgs`, which rejects sensitive-field values and directs you here. Returns a `{data, nextCursor}` envelope. Requires the `orgs:r` scope.
+   * Returns the scope namespaces registered in your account, with the reserved built-ins `org` and `client` listed first. Returns a `{data, nextCursor}` envelope.
    *
-   * @param {Vectros.IdentityLookupRequest} request
+   * @param {Vectros.ListNamespacesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
-   * @throws {@link Vectros.BadRequestError}
-   * @throws {@link Vectros.TooManyRequestsError}
-   *
    * @example
-   *     await client.identity.lookupOrgs({
-   *         type: "person_v1",
-   *         field: "ssn"
-   *     })
+   *     await client.identity.listNamespaces()
    */
-  lookupOrgs(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__lookupOrgs(request, requestOptions));
+  listNamespaces(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listNamespaces(request, requestOptions));
   }
-  async __lookupOrgs(request, requestOptions) {
+  async __listNamespaces(request = {}, requestOptions) {
+    const { startFrom, limit } = request;
+    const _queryParams = {
+      startFrom,
+      limit
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6577,14 +6409,11 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/orgs/lookup"
+        "v1/namespaces"
       ),
-      method: "POST",
+      method: "GET",
       headers: _headers,
-      contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
-      requestType: "json",
-      body: request,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6595,42 +6424,33 @@ var IdentityClient = class {
       return { data: _response.body, rawResponse: _response.rawResponse };
     }
     if (_response.error.reason === "status-code") {
-      switch (_response.error.statusCode) {
-        case 400:
-          throw new BadRequestError(_response.error.body, _response.rawResponse);
-        case 429:
-          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        default:
-          throw new VectrosError({
-            statusCode: _response.error.statusCode,
-            body: _response.error.body,
-            rawResponse: _response.rawResponse
-          });
-      }
+      throw new VectrosError({
+        statusCode: _response.error.statusCode,
+        body: _response.error.body,
+        rawResponse: _response.rawResponse
+      });
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/orgs/lookup");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces");
   }
   /**
-   * Returns the audit trail of changes made to an organization, newest first. Version history is always recorded for identity entities, and sensitive field values are redacted in the history. Requires the `orgs:r` scope.
+   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Requires a root API key. The reserved names `org` and `client` are built in and cannot be registered.
    *
-   * @param {Vectros.GetOrgVersionsRequest} request
+   * @param {Vectros.NamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
-   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.getOrgVersions({
-   *         id: "id"
+   *     await client.identity.registerNamespace({
+   *         namespace: "team"
    *     })
    */
-  getOrgVersions(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__getOrgVersions(request, requestOptions));
+  registerNamespace(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__registerNamespace(request, requestOptions));
   }
-  async __getOrgVersions(request, requestOptions) {
-    const { id, startFrom } = request;
-    const _queryParams = {
-      startFrom
-    };
+  async __registerNamespace(request, requestOptions) {
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6640,11 +6460,14 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/orgs/${url_exports.encodePathParam(id)}/versions`
+        "v1/namespaces"
       ),
-      method: "GET",
+      method: "POST",
       headers: _headers,
-      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6656,8 +6479,12 @@ var IdentityClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
-        case 404:
-          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -6666,7 +6493,7 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/orgs/{id}/versions");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/namespaces");
   }
   /**
    * Returns a paginated list of the users in your account. Pass `externalId` to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply `type` and `field` together with one lookup mode: `value` (exact match), `from`+`to` (range), or `prefix`. Requires the `users:r` scope.
@@ -7543,7 +7370,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/records/batch");
   }
   /**
-   * Returns a paginated list of records in your account as a `{data, nextCursor}` page. Supply exactly one of `type`, `folderId`, or `recent=true` to choose the mode: `type` lists all records of a single type; `folderId` lists all records in a folder (any type); and `recent=true` returns the account-wide recently-updated feed across all types, newest first. You may combine `type` with `folderId` to list a single type within a folder. The owner filters (`userId`, `orgId`, `clientId`) further narrow the type and folder modes; the `recent` feed is standalone and ignores all filters. Each token only sees the record types it is scoped to read. Requires the `records:r` scope. By default the response returns the indexed projection of each record; set `includePayload=true` to include full payloads.
+   * Returns a paginated list of records in your account as a `{data, nextCursor}` page. Supply exactly one of `type`, `folderId`, or `recent=true` to choose the mode: `type` lists all records of a single type; `folderId` lists all records in a folder (any type); and `recent=true` returns the account-wide recently-updated feed across all types, newest first. You may combine `type` with `folderId` to list a single type within a folder. The owner filters (`userId`, `scope`) further narrow the type and folder modes; the `recent` feed is standalone and ignores all filters. Each token only sees the record types it is scoped to read. Requires the `records:r` scope. By default the response returns the indexed projection of each record; set `includePayload=true` to include full payloads.
    *
    * @param {Vectros.ListRecordsRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7553,8 +7380,7 @@ var RecordsClient = class {
    *         type: "intake_form",
    *         folderId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-   *         clientId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
+   *         scope: "group:eng-team",
    *         startFrom: "550e8400-e29b-41d4-a716-446655440000"
    *     })
    */
@@ -7562,13 +7388,12 @@ var RecordsClient = class {
     return HttpResponsePromise.fromPromise(this.__listRecords(request, requestOptions));
   }
   async __listRecords(request = {}, requestOptions) {
-    const { type: type_, folderId, userId, orgId, clientId, startFrom, limit, includePayload, recent } = request;
+    const { type: type_, folderId, userId, scope, startFrom, limit, includePayload, recent } = request;
     const _queryParams = {
       type: type_,
       folderId,
       userId,
-      orgId,
-      clientId,
+      scope,
       startFrom,
       limit,
       includePayload,
@@ -7633,9 +7458,10 @@ var RecordsClient = class {
     return HttpResponsePromise.fromPromise(this.__createRecord(request, requestOptions));
   }
   async __createRecord(request, requestOptions) {
-    const { upsert, body: _body } = request;
+    const { upsert, allowClear, body: _body } = request;
     const _queryParams = {
-      upsert
+      upsert,
+      allowClear
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -7757,7 +7583,10 @@ var RecordsClient = class {
     return HttpResponsePromise.fromPromise(this.__updateRecord(request, requestOptions));
   }
   async __updateRecord(request, requestOptions) {
-    const { id, body: _body } = request;
+    const { id, allowClear, body: _body } = request;
+    const _queryParams = {
+      allowClear
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7772,7 +7601,7 @@ var RecordsClient = class {
       method: "PUT",
       headers: _headers,
       contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
       body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
@@ -7863,7 +7692,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/records/{id}");
   }
   /**
-   * Partially updates a record using an RFC 7386 JSON Merge Patch. The `payload` object is deep-merged into the existing payload: keys you send overwrite (recursing into nested objects), a key set to null is deleted, and keys you omit are left unchanged — so you can change a single field without re-sending the rest (unlike the full-replacement PUT). Top-level fields (`status`, `folderId`, `userId`, `orgId`, `clientId`) are set when present and left unchanged when omitted; sending a top-level field as null is rejected (clearing a top-level field is not supported in this release — omit it instead). `typeName`, `schemaId`, `externalId`, and `indexMode` are immutable and rejected if present. The merged result is validated against the schema. Pass `expectedVersion` to make the patch conditional (optimistic concurrency, 409 on conflict). Requires the `records:u:<type>` scope.
+   * Partially updates a record using an RFC 7386 JSON Merge Patch. The `payload` object is deep-merged into the existing payload: keys you send overwrite (recursing into nested objects), a key set to null is deleted, and keys you omit are left unchanged — so you can change a single field without re-sending the rest (unlike the full-replacement PUT). Top-level fields (`status`, `folderId`, `userId`, `scopes`) are set when present and left unchanged when omitted; sending a top-level field as null is rejected (clearing a top-level field is not supported in this release — omit it instead). `typeName`, `schemaId`, `externalId`, and `indexMode` are immutable and rejected if present. The merged result is validated against the schema. Pass `expectedVersion` to make the patch conditional (optimistic concurrency, 409 on conflict). Requires the `records:u:<type>` scope.
    *
    * @param {Vectros.PatchRecordRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8189,7 +8018,7 @@ var SchemasClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `orgId` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by an identity surface (user, org, or client) lists your account-wide identity schemas regardless of the calling context; filtering by record or document lists within the calling context. Requires the `schemas:r` scope.
+   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `scope` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by an identity surface (`user` or `entity`) lists your account-wide identity schemas regardless of the calling context; filtering by record or document lists within the calling context. Requires the `schemas:r` scope.
    *
    * @param {Vectros.ListSchemasRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8197,7 +8026,7 @@ var SchemasClient = class {
    * @example
    *     await client.schemas.listSchemas({
    *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
+   *         scope: "org:6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    *         surface: "document",
    *         recordType: "intake_form",
    *         startFrom: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
@@ -8207,10 +8036,10 @@ var SchemasClient = class {
     return HttpResponsePromise.fromPromise(this.__listSchemas(request, requestOptions));
   }
   async __listSchemas(request = {}, requestOptions) {
-    const { userId, orgId, surface, recordType, startFrom, limit } = request;
+    const { userId, scope, surface, recordType, startFrom, limit } = request;
     const _queryParams = {
       userId,
-      orgId,
+      scope,
       surface,
       recordType,
       startFrom,
@@ -8656,12 +8485,12 @@ var VectrosClient = class {
   get auth() {
     return this._auth ?? (this._auth = new AuthClient(this._options));
   }
-  get identity() {
-    return this._identity ?? (this._identity = new IdentityClient(this._options));
-  }
   get documents() {
     return this._documents ?? (this._documents = new DocumentsClient(this._options));
   }
+  get identity() {
+    return this._identity ?? (this._identity = new IdentityClient(this._options));
+  }
   get compliance() {
     return this._compliance ?? (this._compliance = new ComplianceClient(this._options));
   }
@@ -8764,8 +8593,8 @@ function warnOnSuboptimalKey(key, log) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  mcpServer: true ? "0.7.0" : "dev",
-  sdk: true ? "0.33.0" : "dev"
+  mcpServer: true ? "0.10.0" : "dev",
+  sdk: true ? "0.35.0" : "dev"
 };
 
 // src/log.ts
@@ -9001,7 +8830,7 @@ ${detail}${pointer}`
 
 // src/tools/hybrid_search.ts
 var MCP_DEFAULT_LIMIT = 3;
-var MCP_MAX_LIMIT = 10;
+var MCP_MAX_LIMIT = 50;
 var MCP_RESPONSE_CHAR_BUDGET = 24e3;
 var SNIPPET_MAX_CHARS = 160;
 var INTERNAL_METADATA_KEYS = /* @__PURE__ */ new Set(["tenantId", "owner_id", "model_type", "rootFolderId", "folderId"]);
@@ -9035,9 +8864,9 @@ var inputSchema = {
     "Keyword-match precision for the BM25 leg (TEXT/HYBRID modes). OR = any term (broad recall), AND = all terms (higher precision), PHRASE = contiguous phrase. Default: PHRASE (slop 3) in HYBRID, OR in TEXT. (The advanced raw-query COMPLEX mode is intentionally not exposed here.)"
   ),
   limit: z.number().int().min(1).max(MCP_MAX_LIMIT).optional().describe(
-    `Max hits to return. MCP-specific cap of ${MCP_MAX_LIMIT} (vs API max of 50) to protect the agent context window. Default 3. Use offset for pagination.`
+    `Max hits per page. Defaults to a low ${MCP_DEFAULT_LIMIT} to protect the agent context window; raise up to ${MCP_MAX_LIMIT} (the most a single search returns) in one call when you can accept the larger result, or page with \`offset\` instead.`
   ),
-  offset: z.number().int().min(0).optional().describe("Skip the first N hits \u2014 for pagination."),
+  offset: z.number().int().min(0).max(200).optional().describe("Skip the first N hits \u2014 for pagination (0\u2013200)."),
   folderId: z.string().optional().describe("Scope to content in this EXACT folder (Vectros folder id)."),
   rootFolderId: z.string().optional().describe("Scope to content under this folder AND all its descendants (subtree-root folder id)."),
   // Content narrowing.
@@ -9050,8 +8879,9 @@ var inputSchema = {
   ),
   // Ownership.
   userId: z.string().optional().describe("Restrict to content owned by this user (Vectros UUID)."),
-  orgId: z.string().optional().describe("Restrict to content belonging to this org (Vectros UUID)."),
-  clientId: z.string().optional().describe("Restrict to content associated with this client (Vectros UUID)."),
+  scope: z.string().optional().describe(
+    'Restrict to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+  ),
   // Date window.
   createdAfter: z.string().optional().describe("Restrict to content created at/after this ISO 8601 UTC timestamp."),
   createdBefore: z.string().optional().describe("Restrict to content created at/before this ISO 8601 UTC timestamp."),
@@ -9069,7 +8899,7 @@ var inputSchema = {
 var hybridSearch = ({ client, log }) => ({
   name: "hybrid_search",
   title: "Hybrid search",
-  description: `Search the partner tenant's indexed content (documents + structured records) using hybrid BM25 + dense ranking. Returns up to 10 results (default 3) with citations and surrounding context for grounding follow-up reasoning. Narrow with contentTypes/typeName/filters, ownership (userId/orgId/clientId), folder scope, a created date window, keyword precision (textMode OR/AND/PHRASE), relevance floors (minSimilarity/minTextRelevance), uniqueDocuments, and requireComplete (fail closed on a degraded backend). Tenant-isolated; the caller's scoped key fully constrains which content is visible. ARCHIVED (soft-retracted) documents never appear in results \u2014 fetch them by id via document_get, or restore them via document_update. To stay within the agent context window each hit returns its matched chunkText + a short snippet by default; set includeContext:true for the broader surrounding passage. If the whole result would be too large it is truncated to the top hits (truncated:true). textLegEmpty:true flags that the keyword leg matched nothing (all textScores 0) \u2014 usually a too-long PHRASE query; retry with textMode:"OR".`,
+  description: "Search your tenant's indexed content (documents + structured records) using hybrid BM25 + dense ranking. Returns up to `limit` results (default 3, max 50 \u2014 raise it in one call when you can accept the larger result) with citations and surrounding context for grounding follow-up reasoning. Narrow with contentTypes/typeName/filters, ownership (userId/scope), folder scope, a created date window, keyword precision (textMode OR/AND/PHRASE), relevance floors (minSimilarity/minTextRelevance), uniqueDocuments, and requireComplete (fail closed on a degraded backend). Tenant-isolated; the caller's scoped key fully constrains which content is visible. ARCHIVED (soft-retracted) documents never appear in results \u2014 fetch them by id via document_get, or restore them via document_update. To stay within the agent context window each hit returns its matched chunkText + a short snippet by default; set includeContext:true for the broader surrounding passage. If the whole result would be too large it is truncated to the top hits (truncated:true). totalResults is the full matching pool and hasMore:true means results remain past this page \u2014 raise limit or advance offset to fetch them. textLegEmpty:true flags that the keyword leg matched nothing (all textScores 0) \u2014 usually a too-long PHRASE query; retry with textMode:\"OR\".",
   inputSchema,
   handler: async (args) => {
     const limit = args.limit ?? MCP_DEFAULT_LIMIT;
@@ -9087,8 +8917,7 @@ var hybridSearch = ({ client, log }) => ({
         typeName: args.typeName,
         filters: args.filters,
         userId: args.userId,
-        orgId: args.orgId,
-        clientId: args.clientId,
+        scope: args.scope,
         createdAfter: args.createdAfter,
         createdBefore: args.createdBefore,
         minSimilarity: args.minSimilarity,
@@ -9115,6 +8944,12 @@ var hybridSearch = ({ client, log }) => ({
         envelope.returnedResults = shaped.length;
         text = JSON.stringify(envelope, null, 2);
       }
+      const offset = args.offset ?? 0;
+      const totalResults = result.totalResults;
+      if (typeof totalResults === "number" && offset + shaped.length < totalResults) {
+        envelope.hasMore = true;
+        text = JSON.stringify(envelope, null, 2);
+      }
       log.debug(
         { tool: "hybrid_search", mode, limit, returned: shaped.length, textLegEmpty },
         "hybrid_search ok"
@@ -9150,7 +8985,7 @@ async function drainPages(fetchPage) {
 
 // src/tools/record_query.ts
 var MCP_DEFAULT_LIMIT2 = 3;
-var MCP_MAX_LIMIT2 = 10;
+var MCP_MAX_LIMIT2 = 100;
 var inputSchema2 = {
   type: z2.string().min(1, "type (record type) is required").describe('Record type / schema name (e.g. "patient", "clinical_note").'),
   // Lookup-mode args — provide `field` plus EXACTLY ONE of: value | from+to | prefix.
@@ -9166,16 +9001,18 @@ var inputSchema2 = {
   ),
   // List-mode args:
   userId: z2.string().optional().describe("List mode: scope to records owned by this user."),
-  orgId: z2.string().optional().describe("List mode: scope to records owned by this org."),
-  clientId: z2.string().optional().describe("List mode: scope to records associated with this client."),
+  scope: z2.string().optional().describe(
+    'List mode: filter to records carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+  ),
+  startFrom: z2.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next. Works in both list and lookup mode."),
   limit: z2.number().int().min(1).max(MCP_MAX_LIMIT2).optional().describe(
-    `Max records to return. MCP-specific cap of ${MCP_MAX_LIMIT2} (vs API max of 100) to protect the agent context window. Default 3.`
+    `Max records per page. Defaults to a low ${MCP_DEFAULT_LIMIT2} to protect the agent context window; raise up to ${MCP_MAX_LIMIT2} (the records API max) in one call when you can accept the larger payload, or page with \`startFrom\` instead.`
   )
 };
 var recordQuery = ({ client, log }) => ({
   name: "record_query",
   title: "Record query (list or lookup)",
-  description: "Query structured records of a given type. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields too.\n  \u2022 List by type: omit `field`; optionally filter by `userId`/`orgId`/`clientId`.\nReturns up to 10 records (default 3). Mode is auto-detected from the arguments present.",
+  description: "Query structured records of a given type. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields too.\n  \u2022 List by type: omit `field`; optionally filter by `userId` or `scope` (`namespace:value`).\nReturns a `{ data, nextCursor }` page: `data` holds up to `limit` records (default 3, max 100 \u2014 raise it in one call when you can accept the payload), and a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page. Mode is auto-detected from the arguments present.",
   inputSchema: inputSchema2,
   handler: async (args) => {
     const limit = args.limit ?? MCP_DEFAULT_LIMIT2;
@@ -9185,8 +9022,9 @@ var recordQuery = ({ client, log }) => ({
     const from = args.from;
     const to = args.to;
     const prefix = args.prefix;
+    const startFrom = args.startFrom;
     try {
-      let records;
+      let page;
       if (field) {
         const hasEquality = value !== void 0;
         const hasRange = from !== void 0 || to !== void 0;
@@ -9209,7 +9047,7 @@ var recordQuery = ({ client, log }) => ({
         if (hasRange && !(from !== void 0 && to !== void 0)) {
           return toolError("record_query", new Error("range lookup requires both 'from' and 'to'."));
         }
-        const page = await client.records.lookupRecordsByBody({
+        page = await client.records.lookupRecordsByBody({
           type,
           field,
           value,
@@ -9217,29 +9055,30 @@ var recordQuery = ({ client, log }) => ({
           to,
           prefix,
           order: args.order,
+          startFrom,
           limit
         });
-        records = pageItems(page);
         log.debug(
-          { tool: "record_query", mode: "lookup", type, field, returned: records.length },
+          { tool: "record_query", mode: "lookup", type, field, returned: pageItems(page).length },
           "record_query lookup ok"
         );
       } else {
-        const page = await client.records.listRecords({
+        page = await client.records.listRecords({
           type,
           userId: args.userId,
-          orgId: args.orgId,
-          clientId: args.clientId,
+          scope: args.scope,
+          startFrom,
           limit
         });
-        records = pageItems(page);
         log.debug(
-          { tool: "record_query", mode: "list", type, limit, returned: records.length },
+          { tool: "record_query", mode: "list", type, limit, returned: pageItems(page).length },
           "record_query list ok"
         );
       }
+      const records = pageItems(page);
+      const nextCursor = page.nextCursor ?? null;
       return {
-        content: [{ type: "text", text: JSON.stringify(records, null, 2) }]
+        content: [{ type: "text", text: JSON.stringify({ data: records, nextCursor }, null, 2) }]
       };
     } catch (err) {
       log.warn({ tool: "record_query", err: String(err) }, "record_query failed");
@@ -9361,8 +9200,9 @@ var inputSchema4 = {
   status: z4.string().optional().describe("Record lifecycle status. Defaults to ACTIVE server-side."),
   folderId: z4.string().optional().describe("Group this record into a folder."),
   userId: z4.string().optional().describe("Owning user id."),
-  orgId: z4.string().optional().describe("Owning organization id."),
-  clientId: z4.string().optional().describe("Associated client id.")
+  scopes: z4.array(z4.string()).optional().describe(
+    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the record\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE record owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default.'
+  )
 };
 var recordCreate = ({ client, log }) => ({
   name: "record_create",
@@ -9381,8 +9221,7 @@ var recordCreate = ({ client, log }) => ({
           status: args.status,
           folderId: args.folderId,
           userId: args.userId,
-          orgId: args.orgId,
-          clientId: args.clientId
+          scopes: args.scopes
         }
       });
       log.debug({ tool: "record_create", type, id: created.id }, "record_create ok");
@@ -9467,24 +9306,27 @@ var record_delete_default = recordDelete;
 // src/tools/rag_ask.ts
 import { z as z7 } from "zod";
 var SEARCH_MCP_DEFAULT_LIMIT = 5;
-var SEARCH_MCP_MAX_LIMIT = 10;
+var SEARCH_MCP_MAX_LIMIT = 50;
 var inputSchema7 = {
   query: z7.string().min(1, "query must be non-empty").describe("Question to ground against retrieved content."),
   instructions: z7.string().optional().describe(
     'System prompt that overrides the default for the generation step \u2014 e.g. "answer only from the provided context, cite sources, be concise". Default: a generic answer-from-context instruction.'
   ),
   model: z7.string().optional().describe(
-    "Inference model alias (e.g. claude-haiku-4-5, claude-sonnet-4-6, claude-opus-4-8). Default = tier-appropriate Haiku. See GET /v1/models for the catalog the calling key can reach."
+    "Inference model alias (e.g. claude-haiku-4-5, claude-sonnet-5, claude-opus-4-8). Default = tier-appropriate Haiku. See GET /v1/models for the catalog the calling key can reach."
   ),
   search: z7.object({
     mode: z7.enum(["HYBRID", "TEXT", "SEMANTIC"]).optional().describe("Retrieval mode. Default HYBRID."),
-    limit: z7.number().int().min(1).max(SEARCH_MCP_MAX_LIMIT).optional().describe(`Passages to retrieve before generating. Default ${SEARCH_MCP_DEFAULT_LIMIT}, max ${SEARCH_MCP_MAX_LIMIT}.`),
+    limit: z7.number().int().min(1).max(SEARCH_MCP_MAX_LIMIT).optional().describe(
+      `Passages to retrieve before generating (the grounding-corpus size). Default ${SEARCH_MCP_DEFAULT_LIMIT}; raise up to ${SEARCH_MCP_MAX_LIMIT} (the RAG search API max) for a broader corpus when the extra grounding is worth the larger prompt.`
+    ),
     // Retrieval scoping — parity with hybrid_search so an agent can ground the
     // answer on a specific owner / folder / type / metadata subset, not just the
     // whole-tenant corpus.
     userId: z7.string().optional().describe("Restrict retrieval to content owned by this user (Vectros UUID)."),
-    orgId: z7.string().optional().describe("Restrict retrieval to content owned by this org (Vectros UUID)."),
-    clientId: z7.string().optional().describe("Restrict retrieval to content tagged with this client (Vectros UUID)."),
+    scope: z7.string().optional().describe(
+      'Restrict retrieval to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+    ),
     folderId: z7.string().optional().describe("Restrict retrieval to this exact folder."),
     rootFolderId: z7.string().optional().describe("Restrict retrieval to this folder and all its descendants."),
     typeName: z7.string().optional().describe("Restrict record retrieval to this schema type."),
@@ -9502,7 +9344,7 @@ var inputSchema7 = {
 var ragAsk = ({ client, log }) => ({
   name: "rag_ask",
   title: "RAG ask (corpus-wide)",
-  description: "Ask a question grounded against the partner tenant's indexed content. Vectros performs a hybrid search, injects the top-K passages into the prompt, and streams a model answer back. Scope retrieval with `search` (ownership, folder, type, metadata filters, date window) to ground on a subset \u2014 e.g. one patient or one folder \u2014 and steer generation with `instructions` / `temperature`. The full answer is returned as a single response; progress notifications keep the call alive during the 30-45s generation window. Inference runs in-perimeter against AWS Bedrock \u2014 PHI never leaves the BAA boundary.",
+  description: "Ask a question grounded against your tenant's indexed content. Vectros performs a hybrid search, injects the top-K passages into the prompt, and streams a model answer back. Scope retrieval with `search` (ownership, folder, type, metadata filters, date window) to ground on a subset \u2014 e.g. one patient or one folder \u2014 and steer generation with `instructions` / `temperature`. The full answer is returned as a single response; progress notifications keep the call alive during the 30-45s generation window. Inference runs in-perimeter against AWS Bedrock \u2014 PHI never leaves the BAA boundary.",
   inputSchema: inputSchema7,
   handler: async (args, extra) => {
     try {
@@ -9511,8 +9353,7 @@ var ragAsk = ({ client, log }) => ({
         mode: searchArg.mode ?? "HYBRID",
         limit: searchArg.limit ?? SEARCH_MCP_DEFAULT_LIMIT,
         userId: searchArg.userId,
-        orgId: searchArg.orgId,
-        clientId: searchArg.clientId,
+        scope: searchArg.scope,
         folderId: searchArg.folderId,
         rootFolderId: searchArg.rootFolderId,
         typeName: searchArg.typeName,
@@ -9657,32 +9498,32 @@ var inputSchema9 = {
   userId: z9.string().optional().describe(
     "Filter to schemas visible to a specific user. Optional; default returns all schemas the credential can see."
   ),
-  orgId: z9.string().optional().describe(
-    "Filter to schemas visible to a specific org. Optional; default returns all schemas the credential can see."
+  scope: z9.string().optional().describe(
+    'Filter to schemas carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces. Optional; default returns all schemas the credential can see.'
   ),
-  surface: z9.enum(["record", "document", "user", "org", "client"]).optional().describe(
-    "Filter to schemas bindable to this surface \u2014 e.g. `document` to list only document types, or `record` for record types. The identity surfaces (user/org/client) are account-wide. Optional."
+  surface: z9.enum(["record", "document", "user", "entity"]).optional().describe(
+    "Filter to schemas bindable to this surface \u2014 e.g. `document` to list only document types, or `record` for record types. Identity entities in any namespace (org/client/one you registered) bind under the single `entity` surface; `user` and `entity` are account-wide. Optional."
   ),
   recordType: z9.string().optional().describe(
-    'Resolve the single schema for this record type (its natural handle, e.g. "patient") instead of listing \u2014 returns a one-element result, or empty if none. Combine with `surface=user|org|client` for an identity schema. Takes precedence over userId/orgId. Optional.'
+    'Resolve the single schema for this record type (its natural handle, e.g. "patient") instead of listing \u2014 returns a one-element result, or empty if none. Combine with `surface=user|entity` for an identity schema. Takes precedence over userId. Optional.'
   )
 };
 var listSchemas = ({ client, log }) => ({
   name: "list_schemas",
   title: "List record schemas",
-  description: 'List the structured-record schema catalog for the partner tenant. Each schema describes a record type (e.g. "patient", "clinical_note") \u2014 its fields, lookup-indexed fields, and capabilities. Use this to discover what record types exist before calling `record_query`. Filter with `surface` (record/document/user/org/client \u2014 e.g. only document types), `recordType` (resolve one schema by its type name), or `userId`/`orgId`; default returns everything the credential can see.',
+  description: 'List the structured-record schema catalog for your tenant. Each schema describes a record type (e.g. "patient", "clinical_note") \u2014 its fields, lookup-indexed fields, and capabilities. Use this to discover what record types exist before calling `record_query`. Filter with `surface` (record/document/user/entity \u2014 e.g. only document types), `recordType` (resolve one schema by its type name), or `userId`/`scope`; default returns everything the credential can see.',
   inputSchema: inputSchema9,
   handler: async (args) => {
     const userId = args.userId;
-    const orgId = args.orgId;
+    const scope = args.scope;
     const surface = args.surface;
     const recordType = args.recordType;
     try {
       const schemas = await drainPages(
-        (startFrom) => client.schemas.listSchemas({ userId, orgId, surface, recordType, startFrom })
+        (startFrom) => client.schemas.listSchemas({ userId, scope, surface, recordType, startFrom })
       );
       log.debug(
-        { tool: "list_schemas", userId, orgId, surface, recordType, returned: schemas.length },
+        { tool: "list_schemas", userId, scope, surface, recordType, returned: schemas.length },
         "list_schemas ok"
       );
       return {
@@ -9792,7 +9633,7 @@ var document_get_default = documentGet;
 // src/tools/document_query.ts
 import { z as z11 } from "zod";
 var MCP_DEFAULT_LIMIT3 = 3;
-var MCP_MAX_LIMIT3 = 10;
+var MCP_MAX_LIMIT3 = 100;
 var inputSchema11 = {
   // Lookup-mode args — provide `field` plus EXACTLY ONE of: value | from+to | prefix.
   field: z11.string().optional().describe("Lookup mode: name of the lookup-indexed field to query by."),
@@ -9807,16 +9648,18 @@ var inputSchema11 = {
   // List-mode args:
   folderId: z11.string().optional().describe("List mode: only documents in this folder (Vectros folder id)."),
   userId: z11.string().optional().describe("List mode: scope to documents owned by this user."),
-  orgId: z11.string().optional().describe("List mode: scope to documents belonging to this org."),
-  clientId: z11.string().optional().describe("List mode: scope to documents associated with this client."),
+  scope: z11.string().optional().describe(
+    'List mode: filter to documents carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+  ),
+  startFrom: z11.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next. Works in both list and lookup mode."),
   limit: z11.number().int().min(1).max(MCP_MAX_LIMIT3).optional().describe(
-    `Max documents to return. MCP-specific cap of ${MCP_MAX_LIMIT3} (vs API max of 100) to protect the agent context window. Default 3.`
+    `Max documents per page. Defaults to a low ${MCP_DEFAULT_LIMIT3} to protect the agent context window; raise up to ${MCP_MAX_LIMIT3} (the documents API max) in one call when you can accept the larger payload, or page with \`startFrom\` instead.`
   )
 };
 var documentQuery = ({ client, log }) => ({
   name: "document_query",
   title: "Document query (list or lookup)",
-  description: "Query document metadata. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields (equality only there); range/prefix need a range-enabled field.\n  \u2022 List: omit `field`; optionally filter by `folderId`/`userId`/`orgId`/`clientId`.\nReturns up to 10 documents (default 3) as a bare array. Mode is auto-detected. Use document_get for the full text/download URL of one document.",
+  description: "Query document metadata. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields (equality only there); range/prefix need a range-enabled field.\n  \u2022 List: omit `field`; optionally filter by `folderId`/`userId`/`scope` (`namespace:value`).\nReturns a `{ data, nextCursor }` page: `data` holds up to `limit` documents (default 3, max 100 \u2014 raise it in one call when you can accept the payload), and a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page. Mode is auto-detected. Use document_get for the full text/download URL of one document.",
   inputSchema: inputSchema11,
   handler: async (args) => {
     const limit = args.limit ?? MCP_DEFAULT_LIMIT3;
@@ -9826,8 +9669,9 @@ var documentQuery = ({ client, log }) => ({
     const to = args.to;
     const prefix = args.prefix;
     const type = args.type;
+    const startFrom = args.startFrom;
     try {
-      let documents;
+      let page;
       if (field) {
         const hasEquality = value !== void 0;
         const hasRange = from !== void 0 || to !== void 0;
@@ -9856,7 +9700,7 @@ var documentQuery = ({ client, log }) => ({
             new Error("lookup requires 'type' (the document's bound schema type) alongside 'field'.")
           );
         }
-        const page = await client.documents.lookupDocumentsByBody({
+        page = await client.documents.lookupDocumentsByBody({
           type,
           field,
           value,
@@ -9864,28 +9708,29 @@ var documentQuery = ({ client, log }) => ({
           to,
           prefix,
           order: args.order,
+          startFrom,
           limit
         });
-        documents = pageItems(page);
         log.debug(
-          { tool: "document_query", mode: "lookup", type, field, returned: documents.length },
+          { tool: "document_query", mode: "lookup", type, field, returned: pageItems(page).length },
           "document_query lookup ok"
         );
       } else {
-        const page = await client.documents.listDocuments({
+        page = await client.documents.listDocuments({
           folderId: args.folderId,
           userId: args.userId,
-          orgId: args.orgId,
-          clientId: args.clientId,
+          scope: args.scope,
+          startFrom,
           limit
         });
-        documents = pageItems(page);
         log.debug(
-          { tool: "document_query", mode: "list", limit, returned: documents.length },
+          { tool: "document_query", mode: "list", limit, returned: pageItems(page).length },
           "document_query list ok"
         );
       }
-      return { content: [{ type: "text", text: JSON.stringify(documents, null, 2) }] };
+      const documents = pageItems(page);
+      const nextCursor = page.nextCursor ?? null;
+      return { content: [{ type: "text", text: JSON.stringify({ data: documents, nextCursor }, null, 2) }] };
     } catch (err) {
       log.warn({ tool: "document_query", err: String(err) }, "document_query failed");
       return toolError("document_query", err);
@@ -9914,8 +9759,9 @@ var inputSchema12 = {
     "Lifecycle status. `ARCHIVED` soft-retracts the document \u2014 it is pulled from search and recall but kept and recoverable; set it back to `ACTIVE` to re-index and restore it. The way to retire superseded content when the credential has no delete authority. Omit to leave unchanged."
   ),
   userId: z12.string().optional().describe("Reassign the owning user (Vectros UUID)."),
-  orgId: z12.string().optional().describe("Reassign the owning org (Vectros UUID)."),
-  clientId: z12.string().optional().describe("Reassign the associated client (Vectros UUID)."),
+  scopes: z12.array(z12.string()).optional().describe(
+    'Reassign scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]) \u2014 the COMPLETE new parent set. `org`/`client` are built-in namespaces. Omit to leave ownership unchanged; `[]` clears it (private to the owning user).'
+  ),
   expectedVersion: z12.number().int().optional().describe(
     "Optimistic concurrency: the version you last read. If the document changed since, the update is refused as a conflict (re-read and retry). Omit for last-write-wins."
   )
@@ -9935,8 +9781,7 @@ var documentUpdate = ({ client, log }) => ({
     const folderId = args.folderId;
     const status = args.status;
     const userId = args.userId;
-    const orgId = args.orgId;
-    const clientId = args.clientId;
+    const scopes = args.scopes;
     const expectedVersion = args.expectedVersion;
     try {
       const resolved = await resolveDocumentIdByExternalId(client, { id: documentId, externalId, type });
@@ -9948,8 +9793,7 @@ var documentUpdate = ({ client, log }) => ({
       if (folderId !== void 0) body.folderId = folderId;
       if (status !== void 0) body.status = status;
       if (userId !== void 0) body.userId = userId;
-      if (orgId !== void 0) body.orgId = orgId;
-      if (clientId !== void 0) body.clientId = clientId;
+      if (scopes !== void 0) body.scopes = scopes;
       if (expectedVersion !== void 0) body.expectedVersion = expectedVersion;
       const updated = await client.documents.patchDocument({
         id: resolved.id,
@@ -9994,20 +9838,23 @@ var document_delete_default = documentDelete;
 // src/tools/folder_query.ts
 import { z as z14 } from "zod";
 var MCP_DEFAULT_LIMIT4 = 10;
-var MCP_MAX_LIMIT4 = 50;
+var MCP_MAX_LIMIT4 = 100;
 var inputSchema14 = {
   id: z14.string().optional().describe("Get mode: fetch this single folder by id."),
   parentId: z14.string().optional().describe("List mode: direct children of this folder (tree navigation). Omit for a flat tenant list."),
   userId: z14.string().optional().describe("List mode: scope to folders owned by this user."),
-  orgId: z14.string().optional().describe("List mode: scope to folders belonging to this org."),
-  clientId: z14.string().optional().describe("List mode: scope to folders associated with this client."),
+  scope: z14.string().optional().describe(
+    'List mode: filter to folders carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+  ),
   startFrom: z14.string().optional().describe("List mode: pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next."),
-  limit: z14.number().int().min(1).max(MCP_MAX_LIMIT4).optional().describe(`List mode: max folders to return. MCP cap of ${MCP_MAX_LIMIT4} (vs API 100). Default 10.`)
+  limit: z14.number().int().min(1).max(MCP_MAX_LIMIT4).optional().describe(
+    `List mode: max folders per page. Default 10; raise up to ${MCP_MAX_LIMIT4} (the folders API max) in one call when you can accept the larger page, or page with \`startFrom\`.`
+  )
 };
 var folderQuery = ({ client, log }) => ({
   name: "folder_query",
   title: "Folder query (list or get)",
-  description: "Read folders. Two modes:\n  \u2022 Get: pass `id` \u2192 returns the single folder.\n  \u2022 List: omit `id`; pass `parentId` for a folder's direct children (tree navigation) or omit for a flat tenant list. Optionally filter by `userId`/`orgId`/`clientId`.\nList mode returns `{ data, nextCursor }` (default 10, max 50 per page); pass `nextCursor` back as `startFrom` to page through all folders. Get mode returns the single folder object.",
+  description: "Read folders. Two modes:\n  \u2022 Get: pass `id` \u2192 returns the single folder.\n  \u2022 List: omit `id`; pass `parentId` for a folder's direct children (tree navigation) or omit for a flat tenant list. Optionally filter by `userId` or `scope` (`namespace:value`).\nList mode returns `{ data, nextCursor }` (default 10, max 100 per page \u2014 raise it in one call when you can accept the larger page); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page through all folders. Get mode returns the single folder object.",
   inputSchema: inputSchema14,
   handler: async (args) => {
     const id = args.id;
@@ -10021,8 +9868,7 @@ var folderQuery = ({ client, log }) => ({
       const page = await client.folders.listFolders({
         parentFolderId: args.parentId,
         userId: args.userId,
-        orgId: args.orgId,
-        clientId: args.clientId,
+        scope: args.scope,
         startFrom: args.startFrom,
         limit
       });
@@ -10046,8 +9892,9 @@ var inputSchema15 = {
   parentId: z15.string().optional().describe("Parent folder id \u2014 places the folder under this parent. Omit for the context default root. Create-only."),
   slug: z15.string().optional().describe("Optional stable slug (sibling-unique; idempotency key). Lowercase letters/digits/hyphens. Derived from name when omitted."),
   userId: z15.string().optional().describe("Owning user (Vectros UUID)."),
-  orgId: z15.string().optional().describe("Owning org (Vectros UUID)."),
-  clientId: z15.string().optional().describe("Associated client (Vectros UUID).")
+  scopes: z15.array(z15.string()).optional().describe(
+    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the folder\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE folder owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default.'
+  )
 };
 var folderCreate = ({ client, log }) => ({
   name: "folder_create",
@@ -10063,8 +9910,7 @@ var folderCreate = ({ client, log }) => ({
           parentFolderId: args.parentId,
           slug: args.slug,
           userId: args.userId,
-          orgId: args.orgId,
-          clientId: args.clientId
+          scopes: args.scopes
         }
       });
       log.debug({ tool: "folder_create", id: folder.id, name: folder.name }, "folder_create ok");
@@ -10084,8 +9930,9 @@ var inputSchema16 = {
   name: z16.string().optional().describe("New folder name. Omit to keep the current name."),
   description: z16.string().optional().describe("New description. Omit to leave unchanged."),
   userId: z16.string().optional().describe("Reassign the owning user (Vectros UUID)."),
-  orgId: z16.string().optional().describe("Reassign the owning org (Vectros UUID)."),
-  clientId: z16.string().optional().describe("Reassign the associated client (Vectros UUID)."),
+  scopes: z16.array(z16.string()).optional().describe(
+    'Reassign scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]) \u2014 the COMPLETE new parent set. `org`/`client` are built-in namespaces. Omit to leave ownership unchanged; `[]` clears it (private to the owning user).'
+  ),
   expectedVersion: z16.number().int().optional().describe(
     "Optimistic concurrency: the version you last read. If the folder changed since, the update is refused as a conflict (re-read and retry). Omit for last-write-wins."
   )
@@ -10100,16 +9947,14 @@ var folderUpdate = ({ client, log }) => ({
     const name = args.name;
     const description = args.description;
     const userId = args.userId;
-    const orgId = args.orgId;
-    const clientId = args.clientId;
+    const scopes = args.scopes;
     const expectedVersion = args.expectedVersion;
     try {
       const body = {};
       if (name !== void 0) body.name = name;
       if (description !== void 0) body.description = description;
       if (userId !== void 0) body.userId = userId;
-      if (orgId !== void 0) body.orgId = orgId;
-      if (clientId !== void 0) body.clientId = clientId;
+      if (scopes !== void 0) body.scopes = scopes;
       if (expectedVersion !== void 0) body.expectedVersion = expectedVersion;
       const updated = await client.folders.patchFolder({ id, body });
       log.debug({ tool: "folder_update", id }, "folder_update ok");
@@ -10275,8 +10120,9 @@ var inputSchema19 = {
   // Common (both modes):
   folderId: z18.string().optional().describe("Optional folder to ingest into. Default: tenant root."),
   userId: z18.string().optional().describe("Owning user ID. Optional."),
-  orgId: z18.string().optional().describe("Owning org ID. Optional."),
-  clientId: z18.string().optional().describe("Owning client ID. Optional.")
+  scopes: z18.array(z18.string()).optional().describe(
+    "TEXT MODE ONLY. Scope ownership as `namespace:value` entries, at most 2 (e.g. [\"org:<uuid>\", \"group:eng-team\"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the document's COMPLETE scope declaration and values must come from the credential's own identity. An empty array `[]` creates a PRIVATE document owned by the calling user alone. Omit to stamp the credential's full identity \u2014 the default. Rejected with `filePath` (file uploads do not accept a scope declaration): a file-uploaded document is stamped with the credential's full identity."
+  )
 };
 var documentIngest = ({ client, log, transport, ingestRoot }) => ({
   name: "document_ingest",
@@ -10310,14 +10156,20 @@ var documentIngest = ({ client, log, transport, ingestRoot }) => ({
         )
       );
     }
+    if (filePath && args.scopes !== void 0) {
+      return toolError(
+        "document_ingest",
+        new Error(
+          "`scopes` is not supported with `filePath` \u2014 file uploads do not accept a scope declaration, and silently ignoring it could make an intended-private document team-visible. Use `text` mode to declare scopes, or omit `scopes` (the upload is stamped with the credential's full identity)."
+        )
+      );
+    }
     const common = {
       folderId: args.folderId,
       payload: args.payload,
       schemaId,
       externalId: args.externalId,
-      userId: args.userId,
-      orgId: args.orgId,
-      clientId: args.clientId
+      userId: args.userId
     };
     try {
       if (text) {
@@ -10327,6 +10179,9 @@ var documentIngest = ({ client, log, transport, ingestRoot }) => ({
             title,
             text,
             indexMode,
+            // Scope ownership is a TEXT-mode contract only (the upload-init
+            // endpoint has no scopes field — see the gate above).
+            scopes: args.scopes,
             ...common
           }
         });
@@ -10419,9 +10274,11 @@ var document_ingest_default = documentIngest;
 // src/tools/lookup_principal.ts
 import { z as z19 } from "zod";
 var MCP_DEFAULT_LIMIT5 = 10;
-var MCP_MAX_LIMIT5 = 50;
+var MCP_MAX_LIMIT5 = 100;
 var inputSchema20 = {
-  kind: z19.enum(["user", "org", "client"]).describe("Which principal to look up: a user, an organization, or a client."),
+  kind: z19.string().describe(
+    'Which principal to look up: "user" (the fixed principal surface), or an entity namespace \u2014 "org", "client" (built in), or a namespace you registered.'
+  ),
   externalId: z19.string().optional().describe(
     "Resolve mode: your own stable identifier for the principal. Returns the single matching principal (with its Vectros UUID), or an empty array if none. The fastest path to the UUID the ownership filters need. Takes precedence if both this and a `field` lookup are supplied."
   ),
@@ -10433,15 +10290,19 @@ var inputSchema20 = {
   to: z19.string().optional().describe("Lookup mode (range): inclusive upper bound; requires `from`."),
   prefix: z19.string().optional().describe("Lookup mode (prefix): match values starting with this. Range-enabled string fields only."),
   order: z19.enum(["asc", "desc"]).optional().describe("Lookup mode: sort direction by the looked-up field. `asc` (default) or `desc`."),
-  limit: z19.number().int().min(1).max(MCP_MAX_LIMIT5).optional().describe(`Max principals to return. MCP cap of ${MCP_MAX_LIMIT5} (vs API 100). Default ${MCP_DEFAULT_LIMIT5}.`)
+  startFrom: z19.string().optional().describe("Lookup mode: pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next."),
+  limit: z19.number().int().min(1).max(MCP_MAX_LIMIT5).optional().describe(
+    `Max principals per page. Defaults to ${MCP_DEFAULT_LIMIT5}; raise up to ${MCP_MAX_LIMIT5} (the principals API max) in one call when you can accept the payload, or page with \`startFrom\`.`
+  )
 };
 var lookupPrincipal = ({ client, log }) => ({
   name: "lookup_principal",
-  title: "Look up a user / org / client identity",
-  description: "Resolve a user, org, or client identity. Two modes:\n  \u2022 Resolve by your own id: pass `externalId` \u2192 the matching principal incl. its Vectros UUID (the id the ownership filters on record_query / hybrid_search / rag_ask expect).\n  \u2022 Lookup by a schema field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Sensitive-field-safe. (If both `externalId` and a `field` lookup are given, `externalId` wins.) Returns up to 50 principals (default 10) as a bare array. Read-only \u2014 does not create or modify identities.",
+  title: "Look up a user identity or a namespaced identity entity",
+  description: "Resolve a user, or an identity entity in a namespace (org/client/one you registered). Two modes:\n  \u2022 Resolve by your own id: pass `externalId` \u2192 the matching principal incl. its Vectros UUID (the id the ownership filters on record_query / hybrid_search / rag_ask expect).\n  \u2022 Lookup by a schema field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Sensitive-field-safe. (If both `externalId` and a `field` lookup are given, `externalId` wins.) Returns a `{ data, nextCursor }` page (default 10, max 100 \u2014 raise it in one call when you can accept the payload); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom`. Read-only \u2014 does not create or modify identities.",
   inputSchema: inputSchema20,
   handler: async (args) => {
     const kind = args.kind;
+    const isUser = kind === "user";
     const limit = args.limit ?? MCP_DEFAULT_LIMIT5;
     const externalId = args.externalId;
     const type = args.type;
@@ -10451,16 +10312,11 @@ var lookupPrincipal = ({ client, log }) => ({
     const to = args.to;
     const prefix = args.prefix;
     const order = args.order;
+    const startFrom = args.startFrom;
     try {
       let page;
       if (externalId !== void 0) {
-        if (kind === "user") {
-          page = await client.identity.listUsers({ externalId, limit });
-        } else if (kind === "org") {
-          page = await client.identity.listOrgs({ externalId, limit });
-        } else {
-          page = await client.identity.listClients({ externalId, limit });
-        }
+        page = isUser ? await client.identity.listUsers({ externalId, limit }) : await client.identity.listEntities({ namespace: kind, externalId, limit });
         log.debug({ tool: "lookup_principal", mode: "resolve", kind }, "lookup_principal resolve ok");
       } else if (field !== void 0) {
         const hasEquality = value !== void 0;
@@ -10488,14 +10344,8 @@ var lookupPrincipal = ({ client, log }) => ({
             new Error("lookup requires 'type' (the identity schema's record type) alongside 'field'.")
           );
         }
-        const req = { type, field, value, from, to, prefix, order, limit };
-        if (kind === "user") {
-          page = await client.identity.lookupUsers(req);
-        } else if (kind === "org") {
-          page = await client.identity.lookupOrgs(req);
-        } else {
-          page = await client.identity.lookupClients(req);
-        }
+        const req = { type, field, value, from, to, prefix, order, startFrom, limit };
+        page = isUser ? await client.identity.lookupUsers(req) : await client.identity.lookupEntities({ namespace: kind, body: req });
         log.debug({ tool: "lookup_principal", mode: "lookup", kind, type, field }, "lookup_principal lookup ok");
       } else {
         return toolError(
@@ -10504,7 +10354,8 @@ var lookupPrincipal = ({ client, log }) => ({
         );
       }
       const principals = pageItems(page);
-      return { content: [{ type: "text", text: JSON.stringify(principals, null, 2) }] };
+      const nextCursor = page.nextCursor ?? null;
+      return { content: [{ type: "text", text: JSON.stringify({ data: principals, nextCursor }, null, 2) }] };
     } catch (err) {
       log.warn({ tool: "lookup_principal", kind, err: String(err) }, "lookup_principal failed");
       return toolError("lookup_principal", err);
@@ -11086,10 +10937,144 @@ function parseToolsEnv(value) {
   return requested;
 }
 
+// src/resolve-key.ts
+import { execFile } from "child_process";
+import { statSync } from "fs";
+import path from "path";
+var HELPER_COMMAND = "vectros";
+var HELPER_TIMEOUT_MS = 1e4;
+var HELPER_MAX_BUFFER = 64 * 1024;
+var ALIAS_RE = /^[A-Za-z0-9._-]+$/;
+var SECRET_RE = /(?:ssk|sk|st)_(?:live|test)_[A-Za-z0-9._-]+/gi;
+var DETAIL_MAX_CHARS = 200;
+async function resolveApiKey(deps = {}) {
+  const env = deps.env ?? process.env;
+  const envKey = env.VECTROS_API_KEY;
+  if (envKey && envKey.trim().length > 0) {
+    return { key: envKey.trim(), source: "env" };
+  }
+  const alias = env.VECTROS_KEYRING_ALIAS?.trim() || void 0;
+  if (alias !== void 0 && !ALIAS_RE.test(alias)) {
+    return {
+      source: "none",
+      reason: "bad-alias",
+      detail: "VECTROS_KEYRING_ALIAS must be letters, digits, dot, dash, or underscore."
+    };
+  }
+  const runHelper = deps.runHelper ?? defaultRunHelper;
+  const outcome = await runHelper({ alias, env });
+  switch (outcome.status) {
+    case "ok":
+      return { key: outcome.secret, source: "keyring", alias };
+    case "cli-absent":
+      return { source: "none", reason: "cli-absent", alias };
+    // Redact HERE as well as in mapExecResult: `runHelper` is a public injectable
+    // seam, so redacting only inside the default implementation would leave any
+    // other implementation's text to reach the fatal log raw. Belongs at the sink.
+    case "no-usable-key":
+      return {
+        source: "none",
+        reason: "no-usable-key",
+        alias,
+        detail: outcome.detail ? redactDetail(outcome.detail) : void 0
+      };
+    case "error":
+      return { source: "none", reason: "helper-failed", alias, detail: redactDetail(outcome.detail) };
+  }
+}
+function noKeyMessage(resolved) {
+  const setEnv = "set VECTROS_API_KEY to a Vectros key (recommended: ssk_live_\u2026)";
+  switch (resolved.reason) {
+    case "cli-absent":
+      return `no API key: VECTROS_API_KEY is unset and the \`vectros\` CLI is not on PATH. Either ${setEnv}, or install @vectros-ai/cli and run \`vectros switch <alias>\`.`;
+    case "no-usable-key":
+      return `no API key: VECTROS_API_KEY is unset and \`vectros keyring show\` returned no key${resolved.detail ? ` \u2014 ${resolved.detail}` : ""}. Run \`vectros switch <alias>\` to pick an identity, \`vectros keyring doctor\` to inspect the keyring (CLI 0.10.0+), upgrade @vectros-ai/cli if it predates the keyring (0.9.0), or ${setEnv}.`;
+    case "bad-alias":
+      return `invalid VECTROS_KEYRING_ALIAS: ${resolved.detail ?? "not a valid keyring alias"} Run \`vectros keyring list\` to see the entry names, unset it to use the active identity, or ${setEnv}.`;
+    case "helper-failed":
+      return `no API key: VECTROS_API_KEY is unset and the \`vectros keyring show\` helper failed (${resolved.detail ?? "unknown error"}). Upgrade @vectros-ai/cli if it is an old build, or ${setEnv} to bypass the keyring.`;
+    default:
+      return `no API key: ${setEnv}.`;
+  }
+}
+function keyringNotice(resolved) {
+  if (resolved.source !== "keyring") return void 0;
+  if (resolved.alias !== void 0) {
+    return { level: "info", alias: resolved.alias, message: "resolved API key from the vectros CLI keyring" };
+  }
+  return {
+    level: "warn",
+    alias: "(active)",
+    message: "resolved API key from the vectros CLI keyring: no entry was named, so this server is running as whatever identity `vectros switch` last made active. Set VECTROS_API_KEY, or VECTROS_KEYRING_ALIAS, to choose deliberately \u2014 `vectros keyring doctor` shows which entry is active and whether it holds a live key."
+  };
+}
+function redactDetail(message) {
+  const redacted = message.replace(/\s+/g, " ").trim().replace(SECRET_RE, "[redacted]");
+  return redacted.length > DETAIL_MAX_CHARS ? `${redacted.slice(0, DETAIL_MAX_CHARS)}\u2026` : redacted;
+}
+function resolveCommandPath(command, env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? env.path ?? "";
+  if (!pathVar) return void 0;
+  const exts = platform === "win32" ? (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.trim()).filter(Boolean) : [""];
+  for (const rawDir of pathVar.split(path.delimiter)) {
+    const dir = rawDir.trim().replace(/^"(.*)"$/, "$1");
+    if (!dir || !path.isAbsolute(dir)) continue;
+    for (const ext of exts) {
+      const candidate = path.join(dir, command + ext);
+      try {
+        if (statSync(candidate).isFile()) return candidate;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+function mapExecResult(err, stdout, stderr = "") {
+  if (!err) {
+    const secret = stdout.trim();
+    return secret ? { status: "ok", secret } : { status: "no-usable-key" };
+  }
+  const code = err.code;
+  if (code === "ENOENT") return { status: "cli-absent" };
+  const detail = redactDetail(stderr.trim() || err.message);
+  if (code === 1 || code === 2) return { status: "no-usable-key", detail: detail || void 0 };
+  return { status: "error", detail };
+}
+function defaultRunHelper({ alias, env }, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const exec = deps.execFileImpl ?? execFile;
+  const resolved = resolveCommandPath(HELPER_COMMAND, env, platform);
+  if (!resolved) return Promise.resolve({ status: "cli-absent" });
+  const isWindows = platform === "win32";
+  const args = ["keyring", "show", "--format", "raw", ...alias ? ["--alias", alias] : []];
+  const file = isWindows ? `"${resolved}"` : resolved;
+  return new Promise((resolve2) => {
+    exec(
+      file,
+      args,
+      {
+        env,
+        timeout: HELPER_TIMEOUT_MS,
+        maxBuffer: HELPER_MAX_BUFFER,
+        windowsHide: true,
+        shell: isWindows
+      },
+      (err, stdout, stderr) => resolve2(mapExecResult(err, String(stdout ?? ""), String(stderr ?? "")))
+    );
+  });
+}
+
 // src/cli-http.ts
 async function main() {
   const log = createLogger2();
-  const apiKey = process.env.VECTROS_API_KEY;
+  const resolved = await resolveApiKey();
+  const apiKey = resolved.key;
+  const notice = keyringNotice(resolved);
+  if (notice) log[notice.level]({ alias: notice.alias }, notice.message);
+  if (!apiKey) {
+    log.fatal({ reason: resolved.reason }, noKeyMessage(resolved));
+    process.exit(1);
+  }
   const apiBaseUrl = process.env.VECTROS_API_BASE_URL;
   if (apiBaseUrl !== void 0) {
     try {