@vectros-ai/mcp-server 0.9.0 → 0.11.0

package/dist/cli-http.js

@@ -41,7 +41,6 @@ __export(api_exports, {
   BatchWriteRequest: () => BatchWriteRequest,
   BatchWriteResult: () => BatchWriteResult,
   ChatMessage: () => ChatMessage,
-  ClientRequest: () => ClientRequest,
   ConflictError: () => ConflictError,
   ContentDeltaEvent: () => ContentDeltaEvent,
   ContentTooLargeError: () => ContentTooLargeError,
@@ -50,6 +49,7 @@ __export(api_exports, {
   DocumentRequest: () => DocumentRequest,
   DocumentResponse: () => DocumentResponse,
   DoneEvent: () => DoneEvent,
+  EntityRequest: () => EntityRequest,
   ErasureCertificate: () => ErasureCertificate,
   ErasureRequest: () => ErasureRequest,
   ErasureRequestResponse: () => ErasureRequestResponse,
@@ -61,16 +61,15 @@ __export(api_exports, {
   FileUploadRequest: () => FileUploadRequest,
   ForbiddenError: () => ForbiddenError,
   IdentityLookupRequest: () => IdentityLookupRequest,
+  IndexFailure: () => IndexFailure,
   InternalServerError: () => InternalServerError,
-  ListClientsRequestOrder: () => ListClientsRequestOrder,
-  ListOrgsRequestOrder: () => ListOrgsRequestOrder,
+  ListEntitiesRequestOrder: () => ListEntitiesRequestOrder,
   ListUsersRequestOrder: () => ListUsersRequestOrder,
   LookupDocumentsRequestOrder: () => LookupDocumentsRequestOrder,
   LookupRecordsRequestOrder: () => LookupRecordsRequestOrder,
   ModelDataVersionResponse: () => ModelDataVersionResponse,
   NotFoundError: () => NotFoundError,
   NotImplementedError: () => NotImplementedError,
-  OrgRequest: () => OrgRequest,
   PaymentRequiredError: () => PaymentRequiredError,
   PingResponse: () => PingResponse,
   RagSearch: () => RagSearch,
@@ -311,11 +310,6 @@ var UnauthorizedError = class extends VectrosError {
 var auth_exports = {};
 var ErasureRequest;
 ((ErasureRequest2) => {
-  ErasureRequest2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
   ErasureRequest2.AuditDisposition = {
     RetainRedacted: "retain-redacted",
     Purge: "purge"
@@ -327,11 +321,6 @@ var ExportRequest;
     Tenant: "tenant",
     Subject: "subject"
   };
-  ExportRequest2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
   ExportRequest2.Format = {
     Ndjson: "ndjson"
   };
@@ -370,15 +359,10 @@ var LookupDocumentsRequestOrder = {
 var folders_exports = {};
 var identity_exports = {};
 __export(identity_exports, {
-  ListClientsRequestOrder: () => ListClientsRequestOrder,
-  ListOrgsRequestOrder: () => ListOrgsRequestOrder,
+  ListEntitiesRequestOrder: () => ListEntitiesRequestOrder,
   ListUsersRequestOrder: () => ListUsersRequestOrder
 });
-var ListClientsRequestOrder = {
-  Asc: "asc",
-  Desc: "desc"
-};
-var ListOrgsRequestOrder = {
+var ListEntitiesRequestOrder = {
   Asc: "asc",
   Desc: "desc"
 };
@@ -477,13 +461,6 @@ var ChatMessage;
     Assistant: "assistant"
   };
 })(ChatMessage || (ChatMessage = {}));
-var ClientRequest;
-((ClientRequest2) => {
-  ClientRequest2.Status = {
-    Active: "ACTIVE",
-    Suspended: "SUSPENDED"
-  };
-})(ClientRequest || (ClientRequest = {}));
 var ContentDeltaEvent;
 ((ContentDeltaEvent2) => {
   ContentDeltaEvent2.Event = {
@@ -538,6 +515,13 @@ var DoneEvent;
     Done: "done"
   };
 })(DoneEvent || (DoneEvent = {}));
+var EntityRequest;
+((EntityRequest2) => {
+  EntityRequest2.Status = {
+    Active: "ACTIVE",
+    Suspended: "SUSPENDED"
+  };
+})(EntityRequest || (EntityRequest = {}));
 var ErasureCertificate;
 ((ErasureCertificate2) => {
   ErasureCertificate2.AuditDisposition = {
@@ -553,11 +537,6 @@ var ErasureRequestResponse;
     Completed: "completed",
     Failed: "failed"
   };
-  ErasureRequestResponse2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
 })(ErasureRequestResponse || (ErasureRequestResponse = {}));
 var ErrorEvent;
 ((ErrorEvent2) => {
@@ -583,11 +562,6 @@ var ExportRequestResponse;
     Tenant: "tenant",
     Subject: "subject"
   };
-  ExportRequestResponse2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
 })(ExportRequestResponse || (ExportRequestResponse = {}));
 var FieldDef;
 ((FieldDef2) => {
@@ -601,13 +575,6 @@ var FieldDef;
     Object: "object",
     Reference: "reference"
   };
-  FieldDef2.TargetSurface = {
-    Record: "record",
-    Document: "document",
-    User: "user",
-    Org: "org",
-    Client: "client"
-  };
 })(FieldDef || (FieldDef = {}));
 var IdentityLookupRequest;
 ((IdentityLookupRequest2) => {
@@ -616,6 +583,17 @@ var IdentityLookupRequest;
     Desc: "desc"
   };
 })(IdentityLookupRequest || (IdentityLookupRequest = {}));
+var IndexFailure;
+((IndexFailure2) => {
+  IndexFailure2.Code = {
+    SourceUnavailable: "SOURCE_UNAVAILABLE",
+    TextIndexFailed: "TEXT_INDEX_FAILED",
+    EmbeddingFailed: "EMBEDDING_FAILED",
+    IndexingFailed: "INDEXING_FAILED",
+    VectorLimitExceeded: "VECTOR_LIMIT_EXCEEDED",
+    Internal: "INTERNAL"
+  };
+})(IndexFailure || (IndexFailure = {}));
 var ModelDataVersionResponse;
 ((ModelDataVersionResponse2) => {
   ModelDataVersionResponse2.ChangeType = {
@@ -624,13 +602,6 @@ var ModelDataVersionResponse;
     Delete: "DELETE"
   };
 })(ModelDataVersionResponse || (ModelDataVersionResponse = {}));
-var OrgRequest;
-((OrgRequest2) => {
-  OrgRequest2.Status = {
-    Active: "ACTIVE",
-    Suspended: "SUSPENDED"
-  };
-})(OrgRequest || (OrgRequest = {}));
 var PingResponse;
 ((PingResponse2) => {
   PingResponse2.Environment = {
@@ -660,11 +631,6 @@ var RagSearch;
 })(RagSearch || (RagSearch = {}));
 var ReadAccessLogResponse;
 ((ReadAccessLogResponse2) => {
-  ReadAccessLogResponse2.SubjectType = {
-    User: "user",
-    Client: "client",
-    Org: "org"
-  };
   ReadAccessLogResponse2.Action = {
     Read: "read",
     List: "list",
@@ -734,8 +700,7 @@ var SchemaRequest;
       Record: "record",
       Document: "document",
       User: "user",
-      Org: "org",
-      Client: "client"
+      Entity: "entity"
     };
   })(AllowedSurfaces = SchemaRequest2.AllowedSurfaces || (SchemaRequest2.AllowedSurfaces = {}));
 })(SchemaRequest || (SchemaRequest = {}));
@@ -758,8 +723,7 @@ var SchemaResponse;
       Record: "record",
       Document: "document",
       User: "user",
-      Org: "org",
-      Client: "client"
+      Entity: "entity"
     };
   })(AllowedSurfaces = SchemaResponse2.AllowedSurfaces || (SchemaResponse2.AllowedSurfaces = {}));
 })(SchemaResponse || (SchemaResponse = {}));
@@ -2314,7 +2278,7 @@ function withNoOpAuthProvider(options) {
     authProvider: new NoOpAuthProvider()
   };
 }
-function handleNonStatusCodeError(error, rawResponse, method, path) {
+function handleNonStatusCodeError(error, rawResponse, method, path2) {
   switch (error.reason) {
     case "non-json":
       throw new VectrosError({
@@ -2328,7 +2292,7 @@ function handleNonStatusCodeError(error, rawResponse, method, path) {
         rawResponse
       });
     case "timeout":
-      throw new VectrosTimeoutError(`Timeout exceeded when calling ${method} ${path}.`, {
+      throw new VectrosTimeoutError(`Timeout exceeded when calling ${method} ${path2}.`, {
         cause: error.cause
       });
     case "unknown":
@@ -2400,7 +2364,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/jwks");
   }
   /**
-   * Returns a page of per-subject PHI read-access rows: who read which subject's PHI, when, against which record, and whether any sensitive value was actually revealed in plaintext. Metadata only — never the PHI itself. This is the disclosure-accounting surface from which a covered entity derives its HIPAA §164.528 accounting of disclosures. Provide at least one query axis: a subject (`subjectType` + `subjectId`, plus optional `clientId`) within a `contextId` for the primary accounting query; `resourceId` within a `contextId` for 'who read this record'; `callerKeyId` for 'what did this credential read' (account-wide forensic); or `contextId` alone to enumerate a whole context. `from`/`to` bound the time window. Results are scoped to your account, derived from your token — never from input. Requires the `access-log:r` scope.
+   * Returns a page of per-subject PHI read-access rows: who read which subject's PHI, when, against which record, and whether any sensitive value was actually revealed in plaintext. Metadata only — never the PHI itself. This is the disclosure-accounting surface from which a covered entity derives its HIPAA §164.528 accounting of disclosures. Provide at least one query axis: a subject (`subjectType` + `subjectId`) within a `contextId` for the primary accounting query; `resourceId` within a `contextId` for 'who read this record'; `callerKeyId` for 'what did this credential read' (account-wide forensic); or `contextId` alone to enumerate a whole context. `from`/`to` bound the time window. Results are scoped to your account, derived from your token — never from input. Requires the `access-log:r` scope.
    *
    * @param {Vectros.GetAccessLogRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -2413,7 +2377,6 @@ var AuthClient = class {
    *         subjectType: "user",
    *         subjectId: "user_abc123",
    *         contextId: "ctx_intake",
-   *         clientId: "client_xyz789",
    *         action: "read",
    *         callerKeyId: "key_abc123",
    *         resourceType: "intake_form",
@@ -2428,7 +2391,6 @@ var AuthClient = class {
       subjectType,
       subjectId,
       contextId,
-      clientId,
       from: from_,
       to,
       action,
@@ -2443,7 +2405,6 @@ var AuthClient = class {
       subjectType,
       subjectId,
       contextId,
-      clientId,
       from: from_,
       to,
       action,
@@ -2877,7 +2838,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope). You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` may set only `orgId` and `clientId`; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
+   * Creates a new access profile under the given app context. This call is idempotent by `principalId`: if a profile with the same `principalId` already exists, the existing profile is returned (with status 200) instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing profile was returned) tells the two apart. To overwrite an existing profile's `scopes`/`roleId`, `identityOverrides`, and `status` instead of returning it unchanged, set `?upsert=true` (this also requires the `profiles:u` scope). You must provide exactly one of `scopes` (an inline list of scopes) or `roleId` (a reference to a role); supplying both, or neither, is rejected. `identityOverrides` is keyed by ownership namespace in `scope:<namespace>` form — `scope:org` and `scope:client` for the reserved namespaces, or any namespace you have registered — and may name at most two; any other key (including the account identifier or `userId`) is rejected. If you use a scoped credential, the profile's effective scopes may not exceed your own; a root API key (`sk_`) is exempt. Requires the `profiles:c` scope.
    *
    * @param {Vectros.CreateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4149,7 +4110,7 @@ var AuthClient = class {
     );
   }
   /**
-   * Creates a short-lived JWT bearer token restricted to specific actions and, optionally, to a particular user, organization, or client. Use this to hand a narrowly-scoped credential to a browser or downstream service so it never sees your root API key. Only callable with a root API key (`sk_*`).
+   * Creates a short-lived JWT bearer token restricted to specific actions and, optionally, to a particular user or identity entity (in any namespace). Use this to hand a narrowly-scoped credential to a browser or downstream service so it never sees your root API key. Only callable with a root API key (`sk_*`).
    *
    * @param {Vectros.TokenRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4167,7 +4128,7 @@ var AuthClient = class {
    *                 "userId": "550e8400-e29b-41d4-a716-446655440000"
    *             },
    *             dataScope: {
-   *                 "orgId": ["6ba7b810-9dad-11d1-80b4-00c04fd430c8"]
+   *                 "scope:org": ["6ba7b810-9dad-11d1-80b4-00c04fd430c8"]
    *             }
    *         },
    *         expiresInSeconds: 3600
@@ -4366,7 +4327,7 @@ var ComplianceClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Submits a right-to-erasure request for a single end-subject (a user, client, or organization). Erasure removes exactly the data the subject solely owns across the declared contexts, plus the subject's identity and lookup rows. It never touches another account's data and never cascades into another subject's data. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
+   * Submits a right-to-erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure removes exactly the data the subject solely owns across the declared contexts, plus the subject's identity and lookup rows. It never touches another account's data and never cascades into another subject's data. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
    *
    * @param {Vectros.ErasureRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4617,7 +4578,7 @@ var DocumentsClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of your documents, optionally filtered by folder (`folderId`) and/or owner (`userId`, `orgId`, `clientId`, or `scope`). The response is a `{data, nextCursor}` envelope; pass `nextCursor` back as `startFrom` to fetch the next page. Requires the `documents:r` scope.
+   * Returns a paginated list of your documents, optionally filtered by folder (`folderId`) and/or owner (`userId` or `scope`). The response is a `{data, nextCursor}` envelope; pass `nextCursor` back as `startFrom` to fetch the next page. Requires the `documents:r` scope.
    *
    * @param {Vectros.ListDocumentsRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4625,8 +4586,6 @@ var DocumentsClient = class {
    * @example
    *     await client.documents.listDocuments({
    *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-   *         clientId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    *         scope: "group:eng-team",
    *         folderId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    *         startFrom: "doc_prev123"
@@ -4636,11 +4595,9 @@ var DocumentsClient = class {
     return HttpResponsePromise.fromPromise(this.__listDocuments(request, requestOptions));
   }
   async __listDocuments(request = {}, requestOptions) {
-    const { userId, orgId, clientId, scope, folderId, startFrom, limit } = request;
+    const { userId, scope, folderId, startFrom, limit } = request;
     const _queryParams = {
       userId,
-      orgId,
-      clientId,
       scope,
       folderId,
       startFrom,
@@ -5373,7 +5330,7 @@ var FoldersClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of your folders. Pass `parentFolderId` to list the direct children of a specific folder (tree navigation); omit it for a flat list across your account. You can also filter by owner using `userId`, `orgId`, or `clientId`. Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `folders:r` scope.
+   * Returns a paginated list of your folders. Pass `parentFolderId` to list the direct children of a specific folder (tree navigation); omit it for a flat list across your account. You can also filter by owner using `userId` or `scope`. Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `folders:r` scope.
    *
    * @param {Vectros.ListFoldersRequest} request
    * @param {FoldersClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5381,9 +5338,8 @@ var FoldersClient = class {
    * @example
    *     await client.folders.listFolders({
    *         parentFolderId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         clientId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
+   *         scope: "group:eng-team",
    *         startFrom: "fld_prev123"
    *     })
    */
@@ -5391,12 +5347,11 @@ var FoldersClient = class {
     return HttpResponsePromise.fromPromise(this.__listFolders(request, requestOptions));
   }
   async __listFolders(request = {}, requestOptions) {
-    const { parentFolderId, orgId, userId, clientId, startFrom, limit } = request;
+    const { parentFolderId, userId, scope, startFrom, limit } = request;
     const _queryParams = {
       parentFolderId,
-      orgId,
       userId,
-      clientId,
+      scope,
       startFrom,
       limit
     };
@@ -5682,7 +5637,7 @@ var FoldersClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/folders/{id}");
   }
   /**
-   * Partially updates a folder using an RFC 7386 JSON Merge Patch. The `name`, `description`, and ownership fields (`userId`, `orgId`, `clientId`) are applied when present and left unchanged when omitted; sending any of these as null is rejected, because clearing a field is not supported in this release (omit it instead). `slug` and `parentFolderId` are immutable — a folder cannot be re-slugged or moved via the API — and the request is rejected if either is present. Pass `expectedVersion` for optimistic concurrency (you get a 409 if the folder changed since you last read it). Requires the `folders:u` scope.
+   * Partially updates a folder using an RFC 7386 JSON Merge Patch. The `name`, `description`, and ownership fields (`userId`, `scopes`) are applied when present and left unchanged when omitted; sending any of these as null is rejected, because clearing a field is not supported in this release (omit it instead). `slug` and `parentFolderId` are immutable — a folder cannot be re-slugged or moved via the API — and the request is rejected if either is present. Pass `expectedVersion` for optimistic concurrency (you get a 409 if the folder changed since you last read it). Requires the `folders:u` scope.
    *
    * @param {Vectros.PatchFolderRequest} request
    * @param {FoldersClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5815,54 +5770,48 @@ var IdentityClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of clients in your account. Narrow the results with `orgId` or `userId`, or use `externalId` for an exact lookup by your own identifier. For schema-bound clients, you can also query by a schema-declared lookup field using `type`, `field`, and one lookup mode (`value` for equality, `from`/`to` for a range, or `prefix`). The response is a `{data, nextCursor}` envelope; pass `nextCursor` back as `startFrom` to fetch the next page. Requires the `clients:r` scope.
+   * Returns a paginated list of entities in a namespace. Filter by `userId` (entities owned by a user), by `externalId` (exact lookup by your own identifier), or by `scope` (`scope=<namespace>:<value>` — entities that have that value as a parent, e.g. `scope=org:6ba7...`). Naming this namespace's own name in `scope` resolves the entity itself (`scope=team:6ba7...` on `/v1/entities/team` returns that team), since an entity is always in its own scope. `userId` and `scope` can be combined to narrow on both dimensions at once; `externalId` identifies a single entity and cannot be combined with either. Requires the `entities:r:<namespace>` scope.
    *
-   * @param {Vectros.ListClientsRequest} request
+   * @param {Vectros.ListEntitiesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @example
-   *     await client.identity.listClients({
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-   *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         externalId: "patient_789",
-   *         startFrom: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
-   *         type: "client_v1",
-   *         field: "industry",
-   *         value: "healthcare",
-   *         prefix: "health"
+   *     await client.identity.listEntities({
+   *         namespace: "team"
    *     })
    */
-  listClients(request = {}, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__listClients(request, requestOptions));
+  listEntities(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listEntities(request, requestOptions));
   }
-  async __listClients(request = {}, requestOptions) {
+  async __listEntities(request, requestOptions) {
     const {
-      orgId,
+      namespace,
       userId,
       externalId,
-      startFrom,
-      limit,
+      scope,
       type: type_,
       field,
       value,
       from: from_,
       to,
       prefix,
-      order
+      order,
+      startFrom,
+      limit
     } = request;
     const _queryParams = {
-      orgId,
       userId,
       externalId,
-      startFrom,
-      limit,
+      scope,
       type: type_,
       field,
       value,
       from: from_,
       to,
       prefix,
-      order: order != null ? order : void 0
+      order: order != null ? order : void 0,
+      startFrom,
+      limit
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -5873,7 +5822,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/clients"
+        `v1/entities/${url_exports.encodePathParam(namespace)}`
       ),
       method: "GET",
       headers: _headers,
@@ -5894,12 +5843,12 @@ var IdentityClient = class {
         rawResponse: _response.rawResponse
       });
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/clients");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/entities/{namespace}");
   }
   /**
-   * Creates a new client identity in your account. This call is idempotent on `externalId`: if a client with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing client was returned) tells the two apart. To overwrite an existing client's content instead of returning it unchanged, set `?upsert=true` (this also requires the `clients:u` scope). Requires the `clients:c` scope.
+   * Creates a new entity in the given namespace. This call is idempotent on `externalId` within the namespace: if an entity with the same `externalId` already exists, the existing record is returned instead of creating a duplicate (`created: false`, HTTP 200). To overwrite an existing entity's content instead of returning it unchanged, set `?upsert=true` (also requires the `entities:u:<namespace>` scope). The namespace must be entity-backed (`org`/`client`, or registered via `POST /v1/namespaces`). Requires the `entities:c:<namespace>` scope.
    *
-   * @param {Vectros.CreateClientRequest} request
+   * @param {Vectros.CreateEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
@@ -5907,17 +5856,18 @@ var IdentityClient = class {
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.createClient({
+   *     await client.identity.createEntity({
+   *         namespace: "team",
    *         body: {
-   *             externalId: "patient_789"
+   *             externalId: "team_eng_platform"
    *         }
    *     })
    */
-  createClient(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__createClient(request, requestOptions));
+  createEntity(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__createEntity(request, requestOptions));
   }
-  async __createClient(request, requestOptions) {
-    const { upsert, body: _body } = request;
+  async __createEntity(request, requestOptions) {
+    const { namespace, upsert, body: _body } = request;
     const _queryParams = {
       upsert
     };
@@ -5930,7 +5880,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/clients"
+        `v1/entities/${url_exports.encodePathParam(namespace)}`
       ),
       method: "POST",
       headers: _headers,
@@ -5963,26 +5913,27 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/clients");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/entities/{namespace}");
   }
   /**
-   * Returns a single client by its Vectros-assigned UUID. Requires the `clients:r` scope.
+   * Retrieves a single entity by its namespace and Vectros-assigned ID. Requires the `entities:r:<namespace>` scope.
    *
-   * @param {Vectros.GetClientRequest} request
+   * @param {Vectros.GetEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    *
    * @example
-   *     await client.identity.getClient({
-   *         id: "f47ac10b-58cc-4372-a567-0e02b2c3d479"
+   *     await client.identity.getEntity({
+   *         namespace: "team",
+   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
    *     })
    */
-  getClient(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__getClient(request, requestOptions));
+  getEntity(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getEntity(request, requestOptions));
   }
-  async __getClient(request, requestOptions) {
-    const { id } = request;
+  async __getEntity(request, requestOptions) {
+    const { namespace, id } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -5992,7 +5943,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/clients/${url_exports.encodePathParam(id)}`
+        `v1/entities/${url_exports.encodePathParam(namespace)}/${url_exports.encodePathParam(id)}`
       ),
       method: "GET",
       headers: _headers,
@@ -6018,30 +5969,31 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/clients/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/entities/{namespace}/{id}");
   }
   /**
-   * Updates mutable fields on an existing client. Omitted fields are preserved (a null does not clear a field); when `payload` is supplied it replaces the stored payload in full rather than being deep-merged. Requires the `clients:u` scope.
+   * Updates the mutable fields of an entity. Omitted fields are preserved (a null value does not clear a field), and the `payload` object is replaced in full when supplied. Providing `scopes` replaces the entity's parent edges. Requires the `entities:u:<namespace>` scope.
    *
-   * @param {Vectros.UpdateClientRequest} request
+   * @param {Vectros.UpdateEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.updateClient({
+   *     await client.identity.updateEntity({
+   *         namespace: "team",
    *         id: "id",
    *         body: {
-   *             externalId: "patient_789"
+   *             externalId: "team_eng_platform"
    *         }
    *     })
    */
-  updateClient(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__updateClient(request, requestOptions));
+  updateEntity(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateEntity(request, requestOptions));
   }
-  async __updateClient(request, requestOptions) {
-    const { id, body: _body } = request;
+  async __updateEntity(request, requestOptions) {
+    const { namespace, id, body: _body } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6051,7 +6003,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/clients/${url_exports.encodePathParam(id)}`
+        `v1/entities/${url_exports.encodePathParam(namespace)}/${url_exports.encodePathParam(id)}`
       ),
       method: "PUT",
       headers: _headers,
@@ -6082,27 +6034,28 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/clients/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/entities/{namespace}/{id}");
   }
   /**
-   * Permanently deletes the client. This action cannot be undone. Requires the `clients:d` scope.
+   * Permanently deletes an entity. This action cannot be undone. Requires the `entities:d:<namespace>` scope.
    *
-   * @param {Vectros.DeleteClientRequest} request
+   * @param {Vectros.DeleteEntityRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.deleteClient({
+   *     await client.identity.deleteEntity({
+   *         namespace: "team",
    *         id: "id"
    *     })
    */
-  deleteClient(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__deleteClient(request, requestOptions));
+  deleteEntity(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteEntity(request, requestOptions));
   }
-  async __deleteClient(request, requestOptions) {
-    const { id } = request;
+  async __deleteEntity(request, requestOptions) {
+    const { namespace, id } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6112,7 +6065,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/clients/${url_exports.encodePathParam(id)}`
+        `v1/entities/${url_exports.encodePathParam(namespace)}/${url_exports.encodePathParam(id)}`
       ),
       method: "DELETE",
       headers: _headers,
@@ -6140,27 +6093,36 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/clients/{id}");
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "DELETE",
+      "/v1/entities/{namespace}/{id}"
+    );
   }
   /**
-   * Body-based equivalent of the `type`/`field`/`value` lookup on `GET /v1/clients`. Use this when looking up by a sensitive (blind-indexed) field: the value travels in the request body rather than the URL. The `GET` list rejects a sensitive field's value and directs you here. The response is a `{data, nextCursor}` envelope. Requires the `clients:r` scope.
+   * Looks up entities in a namespace by a schema-declared field value, with the criteria in the request body instead of the URL. Use this for a sensitive field: the value travels in the body and never appears in the URL. Body equivalent of the `type`/`field`/`value` lookup on `GET /v1/entities/{namespace}`, which rejects sensitive-field values and directs you here. Requires the `entities:r:<namespace>` scope.
    *
-   * @param {Vectros.IdentityLookupRequest} request
+   * @param {Vectros.LookupEntitiesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.lookupClients({
-   *         type: "person_v1",
-   *         field: "ssn"
+   *     await client.identity.lookupEntities({
+   *         namespace: "team",
+   *         body: {
+   *             type: "person_v1",
+   *             field: "ssn"
+   *         }
    *     })
    */
-  lookupClients(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__lookupClients(request, requestOptions));
+  lookupEntities(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__lookupEntities(request, requestOptions));
   }
-  async __lookupClients(request, requestOptions) {
+  async __lookupEntities(request, requestOptions) {
+    const { namespace, body: _body } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6170,14 +6132,14 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/clients/lookup"
+        `v1/entities/${url_exports.encodePathParam(namespace)}/lookup`
       ),
       method: "POST",
       headers: _headers,
       contentType: "application/json",
       queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
       requestType: "json",
-      body: request,
+      body: _body,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6201,26 +6163,32 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/clients/lookup");
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "POST",
+      "/v1/entities/{namespace}/lookup"
+    );
   }
   /**
-   * Returns the audit trail of changes to a client, newest first. Identity auditing is always on, so this history is always available; sensitive field values are redacted in each version. The response is a `{data, nextCursor}` envelope. Requires the `clients:r` scope.
+   * Returns the audit trail of changes made to an entity, newest first. Sensitive field values are redacted in the history. Requires the `entities:r:<namespace>` scope.
    *
-   * @param {Vectros.GetClientVersionsRequest} request
+   * @param {Vectros.GetEntityVersionsRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    *
    * @example
-   *     await client.identity.getClientVersions({
+   *     await client.identity.getEntityVersions({
+   *         namespace: "team",
    *         id: "id"
    *     })
    */
-  getClientVersions(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__getClientVersions(request, requestOptions));
+  getEntityVersions(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getEntityVersions(request, requestOptions));
   }
-  async __getClientVersions(request, requestOptions) {
-    const { id, startFrom } = request;
+  async __getEntityVersions(request, requestOptions) {
+    const { namespace, id, startFrom } = request;
     const _queryParams = {
       startFrom
     };
@@ -6233,7 +6201,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/clients/${url_exports.encodePathParam(id)}/versions`
+        `v1/entities/${url_exports.encodePathParam(namespace)}/${url_exports.encodePathParam(id)}/versions`
       ),
       method: "GET",
       headers: _headers,
@@ -6259,174 +6227,31 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/clients/{id}/versions");
-  }
-  /**
-   * Returns a paginated list of organizations in your account. Filter by `userId` to return only the organizations owned by a specific user, or by `externalId` for an exact lookup using your own identifier. You can also query schema-declared lookup fields by supplying `type` and `field` together with one lookup mode (`value` for equality, `from`/`to` for a range, or `prefix`). Requires the `orgs:r` scope.
-   *
-   * @param {Vectros.ListOrgsRequest} request
-   * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
-   *
-   * @example
-   *     await client.identity.listOrgs({
-   *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         externalId: "clinic_001",
-   *         startFrom: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-   *         type: "org_v1",
-   *         field: "region",
-   *         value: "us-east",
-   *         prefix: "us-"
-   *     })
-   */
-  listOrgs(request = {}, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__listOrgs(request, requestOptions));
-  }
-  async __listOrgs(request = {}, requestOptions) {
-    const {
-      userId,
-      externalId,
-      startFrom,
-      limit,
-      type: type_,
-      field,
-      value,
-      from: from_,
-      to,
-      prefix,
-      order
-    } = request;
-    const _queryParams = {
-      userId,
-      externalId,
-      startFrom,
-      limit,
-      type: type_,
-      field,
-      value,
-      from: from_,
-      to,
-      prefix,
-      order: order != null ? order : void 0
-    };
-    const _authRequest = await this._options.authProvider.getAuthRequest();
-    const _headers = mergeHeaders(
-      _authRequest.headers,
-      this._options?.headers,
-      requestOptions?.headers
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "GET",
+      "/v1/entities/{namespace}/{id}/versions"
     );
-    const _response = await fetcher({
-      url: url_exports.join(
-        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/orgs"
-      ),
-      method: "GET",
-      headers: _headers,
-      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
-      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
-      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
-      abortSignal: requestOptions?.abortSignal,
-      fetchFn: this._options?.fetch,
-      logging: this._options.logging
-    });
-    if (_response.ok) {
-      return { data: _response.body, rawResponse: _response.rawResponse };
-    }
-    if (_response.error.reason === "status-code") {
-      throw new VectrosError({
-        statusCode: _response.error.statusCode,
-        body: _response.error.body,
-        rawResponse: _response.rawResponse
-      });
-    }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/orgs");
   }
   /**
-   * Creates a new organization in your account. This call is idempotent on `externalId`: if an organization with the same `externalId` already exists, the existing record is returned instead of creating a duplicate. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing organization was returned) tells the two apart. To overwrite an existing organization's content instead of returning it unchanged, set `?upsert=true` (this also requires the `orgs:u` scope). Requires the `orgs:c` scope.
+   * Retrieves a single scope-namespace registration by name. The reserved built-ins `org` and `client` are always resolvable.
    *
-   * @param {Vectros.CreateOrgRequest} request
-   * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
-   *
-   * @throws {@link Vectros.BadRequestError}
-   * @throws {@link Vectros.ForbiddenError}
-   * @throws {@link Vectros.TooManyRequestsError}
-   *
-   * @example
-   *     await client.identity.createOrg({
-   *         body: {
-   *             externalId: "clinic_001"
-   *         }
-   *     })
-   */
-  createOrg(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__createOrg(request, requestOptions));
-  }
-  async __createOrg(request, requestOptions) {
-    const { upsert, body: _body } = request;
-    const _queryParams = {
-      upsert
-    };
-    const _authRequest = await this._options.authProvider.getAuthRequest();
-    const _headers = mergeHeaders(
-      _authRequest.headers,
-      this._options?.headers,
-      requestOptions?.headers
-    );
-    const _response = await fetcher({
-      url: url_exports.join(
-        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/orgs"
-      ),
-      method: "POST",
-      headers: _headers,
-      contentType: "application/json",
-      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
-      requestType: "json",
-      body: _body,
-      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
-      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
-      abortSignal: requestOptions?.abortSignal,
-      fetchFn: this._options?.fetch,
-      logging: this._options.logging
-    });
-    if (_response.ok) {
-      return { data: _response.body, rawResponse: _response.rawResponse };
-    }
-    if (_response.error.reason === "status-code") {
-      switch (_response.error.statusCode) {
-        case 400:
-          throw new BadRequestError(_response.error.body, _response.rawResponse);
-        case 403:
-          throw new ForbiddenError(_response.error.body, _response.rawResponse);
-        case 429:
-          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        default:
-          throw new VectrosError({
-            statusCode: _response.error.statusCode,
-            body: _response.error.body,
-            rawResponse: _response.rawResponse
-          });
-      }
-    }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/orgs");
-  }
-  /**
-   * Retrieves a single organization by its Vectros-assigned ID, returning its current name, status, payload, and schema binding. Requires the `orgs:r` scope.
-   *
-   * @param {Vectros.GetOrgRequest} request
+   * @param {Vectros.GetNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
    *
    * @example
-   *     await client.identity.getOrg({
-   *         id: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+   *     await client.identity.getNamespace({
+   *         namespace: "team"
    *     })
    */
-  getOrg(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__getOrg(request, requestOptions));
+  getNamespace(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getNamespace(request, requestOptions));
   }
-  async __getOrg(request, requestOptions) {
-    const { id } = request;
+  async __getNamespace(request, requestOptions) {
+    const { namespace } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6436,7 +6261,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/orgs/${url_exports.encodePathParam(id)}`
+        `v1/namespaces/${url_exports.encodePathParam(namespace)}`
       ),
       method: "GET",
       headers: _headers,
@@ -6462,30 +6287,31 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/orgs/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces/{namespace}");
   }
   /**
-   * Updates the mutable fields of an organization. Omitted fields are preserved (a null value does not clear a field), and the `payload` object is replaced in full when supplied rather than deep-merged. Requires the `orgs:u` scope.
+   * Updates the mutable fields (`entityBacked`, `defaultSchemaId`) of a registered namespace. The namespace name itself is immutable. Requires a root API key. The reserved built-ins cannot be updated.
    *
-   * @param {Vectros.UpdateOrgRequest} request
+   * @param {Vectros.UpdateNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.updateOrg({
-   *         id: "id",
+   *     await client.identity.updateNamespace({
+   *         namespace: "team",
    *         body: {
-   *             externalId: "clinic_001"
+   *             namespace: "team"
    *         }
    *     })
    */
-  updateOrg(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__updateOrg(request, requestOptions));
+  updateNamespace(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__updateNamespace(request, requestOptions));
   }
-  async __updateOrg(request, requestOptions) {
-    const { id, body: _body } = request;
+  async __updateNamespace(request, requestOptions) {
+    const { namespace, body: _body } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6495,7 +6321,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/orgs/${url_exports.encodePathParam(id)}`
+        `v1/namespaces/${url_exports.encodePathParam(namespace)}`
       ),
       method: "PUT",
       headers: _headers,
@@ -6514,6 +6340,8 @@ var IdentityClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
@@ -6526,27 +6354,28 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/orgs/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/namespaces/{namespace}");
   }
   /**
-   * Permanently deletes an organization. This action cannot be undone. Requires the `orgs:d` scope.
+   * Deletes a registered scope namespace. Requires a root API key. The reserved built-ins cannot be deleted. A namespace that still has entities cannot be deleted (409) — delete its entities first; this keeps them reachable by the account-teardown and erasure sweeps.
    *
-   * @param {Vectros.DeleteOrgRequest} request
+   * @param {Vectros.DeleteNamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.deleteOrg({
-   *         id: "id"
+   *     await client.identity.deleteNamespace({
+   *         namespace: "team"
    *     })
    */
-  deleteOrg(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__deleteOrg(request, requestOptions));
+  deleteNamespace(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteNamespace(request, requestOptions));
   }
-  async __deleteOrg(request, requestOptions) {
-    const { id } = request;
+  async __deleteNamespace(request, requestOptions) {
+    const { namespace } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6556,7 +6385,7 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/orgs/${url_exports.encodePathParam(id)}`
+        `v1/namespaces/${url_exports.encodePathParam(namespace)}`
       ),
       method: "DELETE",
       headers: _headers,
@@ -6572,6 +6401,8 @@ var IdentityClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
         case 429:
@@ -6584,27 +6415,26 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/orgs/{id}");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/namespaces/{namespace}");
   }
   /**
-   * Looks up organizations by a schema-declared field value, with the search criteria sent in the request body instead of the URL. Use this when looking up by a sensitive field: the value travels in the body and is never exposed in the URL. This is the body-based equivalent of the `type`/`field`/`value` lookup on `GET /v1/orgs`, which rejects sensitive-field values and directs you here. Returns a `{data, nextCursor}` envelope. Requires the `orgs:r` scope.
+   * Returns the scope namespaces registered in your account, with the reserved built-ins `org` and `client` listed first. Returns a `{data, nextCursor}` envelope.
    *
-   * @param {Vectros.IdentityLookupRequest} request
+   * @param {Vectros.ListNamespacesRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
-   * @throws {@link Vectros.BadRequestError}
-   * @throws {@link Vectros.TooManyRequestsError}
-   *
    * @example
-   *     await client.identity.lookupOrgs({
-   *         type: "person_v1",
-   *         field: "ssn"
-   *     })
+   *     await client.identity.listNamespaces()
    */
-  lookupOrgs(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__lookupOrgs(request, requestOptions));
+  listNamespaces(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listNamespaces(request, requestOptions));
   }
-  async __lookupOrgs(request, requestOptions) {
+  async __listNamespaces(request = {}, requestOptions) {
+    const { startFrom, limit } = request;
+    const _queryParams = {
+      startFrom,
+      limit
+    };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6614,14 +6444,11 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        "v1/orgs/lookup"
+        "v1/namespaces"
       ),
-      method: "POST",
+      method: "GET",
       headers: _headers,
-      contentType: "application/json",
-      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
-      requestType: "json",
-      body: request,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6632,42 +6459,33 @@ var IdentityClient = class {
       return { data: _response.body, rawResponse: _response.rawResponse };
     }
     if (_response.error.reason === "status-code") {
-      switch (_response.error.statusCode) {
-        case 400:
-          throw new BadRequestError(_response.error.body, _response.rawResponse);
-        case 429:
-          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
-        default:
-          throw new VectrosError({
-            statusCode: _response.error.statusCode,
-            body: _response.error.body,
-            rawResponse: _response.rawResponse
-          });
-      }
+      throw new VectrosError({
+        statusCode: _response.error.statusCode,
+        body: _response.error.body,
+        rawResponse: _response.rawResponse
+      });
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/orgs/lookup");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/namespaces");
   }
   /**
-   * Returns the audit trail of changes made to an organization, newest first. Version history is always recorded for identity entities, and sensitive field values are redacted in the history. Requires the `orgs:r` scope.
+   * Registers a new scope namespace and declares whether its values resolve to identity entities (`entityBacked`). Requires a root API key. The reserved names `org` and `client` are built in and cannot be registered.
    *
-   * @param {Vectros.GetOrgVersionsRequest} request
+   * @param {Vectros.NamespaceRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
    *
-   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
-   *     await client.identity.getOrgVersions({
-   *         id: "id"
+   *     await client.identity.registerNamespace({
+   *         namespace: "team"
    *     })
    */
-  getOrgVersions(request, requestOptions) {
-    return HttpResponsePromise.fromPromise(this.__getOrgVersions(request, requestOptions));
+  registerNamespace(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__registerNamespace(request, requestOptions));
   }
-  async __getOrgVersions(request, requestOptions) {
-    const { id, startFrom } = request;
-    const _queryParams = {
-      startFrom
-    };
+  async __registerNamespace(request, requestOptions) {
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -6677,11 +6495,14 @@ var IdentityClient = class {
     const _response = await fetcher({
       url: url_exports.join(
         await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
-        `v1/orgs/${url_exports.encodePathParam(id)}/versions`
+        "v1/namespaces"
       ),
-      method: "GET",
+      method: "POST",
       headers: _headers,
-      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
       timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
       maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
       abortSignal: requestOptions?.abortSignal,
@@ -6693,8 +6514,12 @@ var IdentityClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
-        case 404:
-          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
           throw new VectrosError({
             statusCode: _response.error.statusCode,
@@ -6703,7 +6528,7 @@ var IdentityClient = class {
           });
       }
     }
-    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/orgs/{id}/versions");
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/namespaces");
   }
   /**
    * Returns a paginated list of the users in your account. Pass `externalId` to look up a single user by your own identifier. To filter on schema-declared lookup fields, supply `type` and `field` together with one lookup mode: `value` (exact match), `from`+`to` (range), or `prefix`. Requires the `users:r` scope.
@@ -7580,7 +7405,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/records/batch");
   }
   /**
-   * Returns a paginated list of records in your account as a `{data, nextCursor}` page. Supply exactly one of `type`, `folderId`, or `recent=true` to choose the mode: `type` lists all records of a single type; `folderId` lists all records in a folder (any type); and `recent=true` returns the account-wide recently-updated feed across all types, newest first. You may combine `type` with `folderId` to list a single type within a folder. The owner filters (`userId`, `orgId`, `clientId`, `scope`) further narrow the type and folder modes; the `recent` feed is standalone and ignores all filters. Each token only sees the record types it is scoped to read. Requires the `records:r` scope. By default the response returns the indexed projection of each record; set `includePayload=true` to include full payloads.
+   * Returns a paginated list of records in your account as a `{data, nextCursor}` page. Supply exactly one of `type`, `folderId`, or `recent=true` to choose the mode: `type` lists all records of a single type; `folderId` lists all records in a folder (any type); and `recent=true` returns the account-wide recently-updated feed across all types, newest first. You may combine `type` with `folderId` to list a single type within a folder. The owner filters (`userId`, `scope`) further narrow the type and folder modes; the `recent` feed is standalone and ignores all filters. Each token only sees the record types it is scoped to read. Requires the `records:r` scope. By default the response returns the indexed projection of each record; set `includePayload=true` to include full payloads.
    *
    * @param {Vectros.ListRecordsRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7590,8 +7415,6 @@ var RecordsClient = class {
    *         type: "intake_form",
    *         folderId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-   *         clientId: "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    *         scope: "group:eng-team",
    *         startFrom: "550e8400-e29b-41d4-a716-446655440000"
    *     })
@@ -7600,24 +7423,11 @@ var RecordsClient = class {
     return HttpResponsePromise.fromPromise(this.__listRecords(request, requestOptions));
   }
   async __listRecords(request = {}, requestOptions) {
-    const {
-      type: type_,
-      folderId,
-      userId,
-      orgId,
-      clientId,
-      scope,
-      startFrom,
-      limit,
-      includePayload,
-      recent
-    } = request;
+    const { type: type_, folderId, userId, scope, startFrom, limit, includePayload, recent } = request;
     const _queryParams = {
       type: type_,
       folderId,
       userId,
-      orgId,
-      clientId,
       scope,
       startFrom,
       limit,
@@ -7917,7 +7727,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v1/records/{id}");
   }
   /**
-   * Partially updates a record using an RFC 7386 JSON Merge Patch. The `payload` object is deep-merged into the existing payload: keys you send overwrite (recursing into nested objects), a key set to null is deleted, and keys you omit are left unchanged — so you can change a single field without re-sending the rest (unlike the full-replacement PUT). Top-level fields (`status`, `folderId`, `userId`, `orgId`, `clientId`) are set when present and left unchanged when omitted; sending a top-level field as null is rejected (clearing a top-level field is not supported in this release — omit it instead). `typeName`, `schemaId`, `externalId`, and `indexMode` are immutable and rejected if present. The merged result is validated against the schema. Pass `expectedVersion` to make the patch conditional (optimistic concurrency, 409 on conflict). Requires the `records:u:<type>` scope.
+   * Partially updates a record using an RFC 7386 JSON Merge Patch. The `payload` object is deep-merged into the existing payload: keys you send overwrite (recursing into nested objects), a key set to null is deleted, and keys you omit are left unchanged — so you can change a single field without re-sending the rest (unlike the full-replacement PUT). Top-level fields (`status`, `folderId`, `userId`, `scopes`) are set when present and left unchanged when omitted; sending a top-level field as null is rejected (clearing a top-level field is not supported in this release — omit it instead). `typeName`, `schemaId`, `externalId`, and `indexMode` are immutable and rejected if present. The merged result is validated against the schema. Pass `expectedVersion` to make the patch conditional (optimistic concurrency, 409 on conflict). Requires the `records:u:<type>` scope.
    *
    * @param {Vectros.PatchRecordRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8243,7 +8053,7 @@ var SchemasClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `orgId` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by an identity surface (user, org, or client) lists your account-wide identity schemas regardless of the calling context; filtering by record or document lists within the calling context. Requires the `schemas:r` scope.
+   * Returns a paginated list of the record schemas defined in your account. Filter by `userId` or `scope` to scope to an owner, by `surface` to list the types bindable to one surface, or by `recordType` to resolve the single schema for a type directly. Filtering by an identity surface (`user` or `entity`) lists your account-wide identity schemas regardless of the calling context; filtering by record or document lists within the calling context. Requires the `schemas:r` scope.
    *
    * @param {Vectros.ListSchemasRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -8251,7 +8061,7 @@ var SchemasClient = class {
    * @example
    *     await client.schemas.listSchemas({
    *         userId: "550e8400-e29b-41d4-a716-446655440000",
-   *         orgId: "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
+   *         scope: "org:6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    *         surface: "document",
    *         recordType: "intake_form",
    *         startFrom: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
@@ -8261,10 +8071,10 @@ var SchemasClient = class {
     return HttpResponsePromise.fromPromise(this.__listSchemas(request, requestOptions));
   }
   async __listSchemas(request = {}, requestOptions) {
-    const { userId, orgId, surface, recordType, startFrom, limit } = request;
+    const { userId, scope, surface, recordType, startFrom, limit } = request;
     const _queryParams = {
       userId,
-      orgId,
+      scope,
       surface,
       recordType,
       startFrom,
@@ -8710,12 +8520,12 @@ var VectrosClient = class {
   get auth() {
     return this._auth ?? (this._auth = new AuthClient(this._options));
   }
-  get identity() {
-    return this._identity ?? (this._identity = new IdentityClient(this._options));
-  }
   get documents() {
     return this._documents ?? (this._documents = new DocumentsClient(this._options));
   }
+  get identity() {
+    return this._identity ?? (this._identity = new IdentityClient(this._options));
+  }
   get compliance() {
     return this._compliance ?? (this._compliance = new ComplianceClient(this._options));
   }
@@ -8813,8 +8623,8 @@ function warnOnSuboptimalKey(key, log) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  mcpServer: true ? "0.9.0" : "dev",
-  sdk: true ? "0.34.0" : "dev"
+  mcpServer: true ? "0.11.0" : "dev",
+  sdk: true ? "0.36.0" : "dev"
 };
 
 // src/log.ts
@@ -9018,31 +8828,45 @@ async function consumeStream(stream, onProgress) {
 }
 
 // src/tools/errors.ts
+function asErrorBody(body) {
+  if (body && typeof body === "object") return body;
+  return void 0;
+}
 function toolError(toolName, err, docPointer) {
   let summary = `${toolName} failed`;
   let detail = String(err);
+  let errorCode;
+  let requestId;
   if (err instanceof StreamError) {
     summary = `${toolName} stream error`;
     detail = err.message;
   } else if (err instanceof Error) {
     const e = err;
     detail = e.message;
+    const body = asErrorBody(e.body);
+    if (body) {
+      if (typeof body.message === "string" && body.message.trim().length > 0) detail = body.message;
+      if (typeof body.errorCode === "string" && body.errorCode.length > 0) errorCode = body.errorCode;
+      if (typeof body.requestId === "string" && body.requestId.length > 0) requestId = body.requestId;
+    }
     if (e.statusCode) {
-      summary = `${toolName} failed: HTTP ${e.statusCode}`;
+      summary = `${toolName} failed: HTTP ${e.statusCode}${errorCode ? ` (${errorCode})` : ""}`;
     } else if (e.name && e.name !== "Error") {
       summary = `${toolName} failed: ${e.name}`;
     }
   }
-  const pointer = docPointer ? `
+  const trailer = (errorCode ? `
+errorCode: ${errorCode}` : "") + (requestId ? `
+requestId: ${requestId}` : "") + (docPointer ? `
 
-See: ${docPointer}` : "";
+See: ${docPointer}` : "");
   return {
     isError: true,
     content: [
       {
         type: "text",
         text: `${summary}
-${detail}${pointer}`
+${detail}${trailer}`
       }
     ]
   };
@@ -9099,10 +8923,8 @@ var inputSchema = {
   ),
   // Ownership.
   userId: import_zod.z.string().optional().describe("Restrict to content owned by this user (Vectros UUID)."),
-  orgId: import_zod.z.string().optional().describe("Restrict to content belonging to this org (Vectros UUID)."),
-  clientId: import_zod.z.string().optional().describe("Restrict to content associated with this client (Vectros UUID)."),
   scope: import_zod.z.string().optional().describe(
-    'Restrict to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "group:eng-team"). `scope=org:<id>`/`scope=client:<id>` are equivalent to the orgId/clientId filters.'
+    'Restrict to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
   ),
   // Date window.
   createdAfter: import_zod.z.string().optional().describe("Restrict to content created at/after this ISO 8601 UTC timestamp."),
@@ -9121,7 +8943,7 @@ var inputSchema = {
 var hybridSearch = ({ client, log }) => ({
   name: "hybrid_search",
   title: "Hybrid search",
-  description: "Search your tenant's indexed content (documents + structured records) using hybrid BM25 + dense ranking. Returns up to `limit` results (default 3, max 50 \u2014 raise it in one call when you can accept the larger result) with citations and surrounding context for grounding follow-up reasoning. Narrow with contentTypes/typeName/filters, ownership (userId/orgId/clientId), folder scope, a created date window, keyword precision (textMode OR/AND/PHRASE), relevance floors (minSimilarity/minTextRelevance), uniqueDocuments, and requireComplete (fail closed on a degraded backend). Tenant-isolated; the caller's scoped key fully constrains which content is visible. ARCHIVED (soft-retracted) documents never appear in results \u2014 fetch them by id via document_get, or restore them via document_update. To stay within the agent context window each hit returns its matched chunkText + a short snippet by default; set includeContext:true for the broader surrounding passage. If the whole result would be too large it is truncated to the top hits (truncated:true). totalResults is the full matching pool and hasMore:true means results remain past this page \u2014 raise limit or advance offset to fetch them. textLegEmpty:true flags that the keyword leg matched nothing (all textScores 0) \u2014 usually a too-long PHRASE query; retry with textMode:\"OR\".",
+  description: 'Search your tenant\'s indexed content (documents + structured records) using hybrid BM25 + dense ranking. Returns up to `limit` results (default 3, max 50 \u2014 raise it in one call when you can accept the larger result) with citations and surrounding context for grounding follow-up reasoning. Narrow with contentTypes/typeName/filters, ownership (userId/scope), folder scope, a created date window, keyword precision (textMode OR/AND/PHRASE), relevance floors (minSimilarity/minTextRelevance), uniqueDocuments, and requireComplete (fail closed on a degraded backend). Tenant-isolated; the caller\'s scoped key fully constrains which content is visible. ARCHIVED (soft-retracted) documents never appear in results \u2014 fetch them by id via document_get, or restore them via document_update. To stay within the agent context window each hit returns its matched chunkText + a short snippet by default; set includeContext:true for the broader surrounding passage. If the whole result would be too large it is truncated to the top hits (truncated:true). totalResults is the full matching pool and hasMore:true means results remain past this page \u2014 raise limit or advance offset to fetch them. textLegEmpty:true flags that the keyword (BM25) leg matched nothing (all textScores 0) \u2014 typically the default PHRASE mode finding no contiguous match for a long natural-language query. Loosen the keyword leg: shorten the query to its key terms, or set textMode "AND" (all terms, higher precision) or "OR" (any term, broad recall).',
   inputSchema,
   handler: async (args) => {
     const limit = args.limit ?? MCP_DEFAULT_LIMIT;
@@ -9139,8 +8961,6 @@ var hybridSearch = ({ client, log }) => ({
         typeName: args.typeName,
         filters: args.filters,
         userId: args.userId,
-        orgId: args.orgId,
-        clientId: args.clientId,
         scope: args.scope,
         createdAfter: args.createdAfter,
         createdBefore: args.createdBefore,
@@ -9225,10 +9045,8 @@ var inputSchema2 = {
   ),
   // List-mode args:
   userId: import_zod2.z.string().optional().describe("List mode: scope to records owned by this user."),
-  orgId: import_zod2.z.string().optional().describe("List mode: scope to records owned by this org."),
-  clientId: import_zod2.z.string().optional().describe("List mode: scope to records associated with this client."),
   scope: import_zod2.z.string().optional().describe(
-    'List mode: filter to records carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "group:eng-team"). `scope=org:<id>`/`scope=client:<id>` are equivalent to the orgId/clientId filters.'
+    'List mode: filter to records carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
   ),
   startFrom: import_zod2.z.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next. Works in both list and lookup mode."),
   limit: import_zod2.z.number().int().min(1).max(MCP_MAX_LIMIT2).optional().describe(
@@ -9238,7 +9056,7 @@ var inputSchema2 = {
 var recordQuery = ({ client, log }) => ({
   name: "record_query",
   title: "Record query (list or lookup)",
-  description: "Query structured records of a given type. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields too.\n  \u2022 List by type: omit `field`; optionally filter by `userId`/`orgId`/`clientId`.\nReturns a `{ data, nextCursor }` page: `data` holds up to `limit` records (default 3, max 100 \u2014 raise it in one call when you can accept the payload), and a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page. Mode is auto-detected from the arguments present.",
+  description: "Query structured records of a given type. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields too.\n  \u2022 List by type: omit `field`; optionally filter by `userId` or `scope` (`namespace:value`).\nReturns a `{ data, nextCursor }` page: `data` holds up to `limit` records (default 3, max 100 \u2014 raise it in one call when you can accept the payload), and a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page. Mode is auto-detected from the arguments present.",
   inputSchema: inputSchema2,
   handler: async (args) => {
     const limit = args.limit ?? MCP_DEFAULT_LIMIT2;
@@ -9292,8 +9110,6 @@ var recordQuery = ({ client, log }) => ({
         page = await client.records.listRecords({
           type,
           userId: args.userId,
-          orgId: args.orgId,
-          clientId: args.clientId,
           scope: args.scope,
           startFrom,
           limit
@@ -9379,7 +9195,7 @@ var inputSchema3 = {
 var recordGet = ({ client, log }) => ({
   name: "record_get",
   title: "Get a record by id or externalId",
-  description: "Fetch a single structured record, including the full payload. Select it EITHER by its Vectros `id` (e.g. from record_query / hybrid_search) OR by your own `externalId` + `type` \u2014 the same key you passed to record_create, resolved for you (no manual record_query lookup needed). Very large payloads are truncated to protect the agent context window.",
+  description: "Fetch a single structured record, including the full payload. Select it EITHER by its Vectros `id` (e.g. from record_query / hybrid_search) OR by your own `externalId` + `type` \u2014 the same key you passed to record_create, resolved for you (no manual record_query lookup needed). Very large payloads are truncated to protect the agent context window. The response carries the record's processing `indexStatus`; when it is FAILED an `indexFailure.code` explains whether the content is still searchable (e.g. VECTOR_LIMIT_EXCEEDED keeps keyword search vs INDEXING_FAILED = not findable at all) \u2014 branch on the `code`, not the message.",
   inputSchema: inputSchema3,
   handler: async (args) => {
     const id = args.id;
@@ -9417,7 +9233,7 @@ var import_zod4 = require("zod");
 var inputSchema4 = {
   type: import_zod4.z.string().min(1, "type is required").describe('Record type / schema name (e.g. "task"). Must match an existing schema \u2014 see list_schemas.'),
   fields: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).describe(
-    "The record payload \u2014 a JSON object of field\u2192value, validated against the type schema. Call list_schemas to learn required fields, types, and enum values."
+    "The record payload \u2014 a JSON object of field\u2192value, validated against the type schema. Call list_schemas to learn required fields, types, and enum values. Every number must fall within the signed 64-bit range (a value outside it, or with >38 significant digits, is refused with a 400 naming the field) \u2014 send a larger whole number (e.g. a big external id) as a STRING, which stores it exactly and supports exact-match lookup."
   ),
   externalId: import_zod4.z.string().optional().describe(
     "Stable caller-supplied id. Immutable; unique per type. Re-creating with the same externalId returns the existing record (idempotent) \u2014 use it to make creates safely retryable."
@@ -9428,16 +9244,14 @@ var inputSchema4 = {
   status: import_zod4.z.string().optional().describe("Record lifecycle status. Defaults to ACTIVE server-side."),
   folderId: import_zod4.z.string().optional().describe("Group this record into a folder."),
   userId: import_zod4.z.string().optional().describe("Owning user id."),
-  orgId: import_zod4.z.string().optional().describe("Owning organization id."),
-  clientId: import_zod4.z.string().optional().describe("Associated client id."),
   scopes: import_zod4.z.array(import_zod4.z.string()).optional().describe(
-    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). This is the record\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE record owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default. `org:`/`client:` entries are equivalent to the orgId/clientId fields.'
+    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the record\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE record owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default.'
   )
 };
 var recordCreate = ({ client, log }) => ({
   name: "record_create",
   title: "Create a record",
-  description: "Create a structured record of a given type. Provide `type` and `fields` (the payload, validated against the type schema \u2014 call list_schemas first to learn required fields and enums). Idempotent by `externalId`. Requires the key to allow records:c.",
+  description: "Create a structured record of a given type. Provide `type` and `fields` (the payload, validated against the type schema \u2014 call list_schemas first to learn required fields and enums). Idempotent by `externalId`. Requires the key to allow records:c (and records:r to receive the existing record on a collision).",
   inputSchema: inputSchema4,
   handler: async (args) => {
     const type = args.type;
@@ -9451,8 +9265,6 @@ var recordCreate = ({ client, log }) => ({
           status: args.status,
           folderId: args.folderId,
           userId: args.userId,
-          orgId: args.orgId,
-          clientId: args.clientId,
           scopes: args.scopes
         }
       });
@@ -9556,10 +9368,8 @@ var inputSchema7 = {
     // answer on a specific owner / folder / type / metadata subset, not just the
     // whole-tenant corpus.
     userId: import_zod7.z.string().optional().describe("Restrict retrieval to content owned by this user (Vectros UUID)."),
-    orgId: import_zod7.z.string().optional().describe("Restrict retrieval to content owned by this org (Vectros UUID)."),
-    clientId: import_zod7.z.string().optional().describe("Restrict retrieval to content tagged with this client (Vectros UUID)."),
     scope: import_zod7.z.string().optional().describe(
-      'Restrict retrieval to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "group:eng-team"). `scope=org:<id>`/`scope=client:<id>` are equivalent to the orgId/clientId filters.'
+      'Restrict retrieval to content carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
     ),
     folderId: import_zod7.z.string().optional().describe("Restrict retrieval to this exact folder."),
     rootFolderId: import_zod7.z.string().optional().describe("Restrict retrieval to this folder and all its descendants."),
@@ -9587,8 +9397,6 @@ var ragAsk = ({ client, log }) => ({
         mode: searchArg.mode ?? "HYBRID",
         limit: searchArg.limit ?? SEARCH_MCP_DEFAULT_LIMIT,
         userId: searchArg.userId,
-        orgId: searchArg.orgId,
-        clientId: searchArg.clientId,
         scope: searchArg.scope,
         folderId: searchArg.folderId,
         rootFolderId: searchArg.rootFolderId,
@@ -9734,32 +9542,32 @@ var inputSchema9 = {
   userId: import_zod9.z.string().optional().describe(
     "Filter to schemas visible to a specific user. Optional; default returns all schemas the credential can see."
   ),
-  orgId: import_zod9.z.string().optional().describe(
-    "Filter to schemas visible to a specific org. Optional; default returns all schemas the credential can see."
+  scope: import_zod9.z.string().optional().describe(
+    'Filter to schemas carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces. Optional; default returns all schemas the credential can see.'
   ),
-  surface: import_zod9.z.enum(["record", "document", "user", "org", "client"]).optional().describe(
-    "Filter to schemas bindable to this surface \u2014 e.g. `document` to list only document types, or `record` for record types. The identity surfaces (user/org/client) are account-wide. Optional."
+  surface: import_zod9.z.enum(["record", "document", "user", "entity"]).optional().describe(
+    "Filter to schemas bindable to this surface \u2014 e.g. `document` to list only document types, or `record` for record types. Identity entities in any namespace (org/client/one you registered) bind under the single `entity` surface; `user` and `entity` are account-wide. Optional."
   ),
   recordType: import_zod9.z.string().optional().describe(
-    'Resolve the single schema for this record type (its natural handle, e.g. "patient") instead of listing \u2014 returns a one-element result, or empty if none. Combine with `surface=user|org|client` for an identity schema. Takes precedence over userId/orgId. Optional.'
+    'Resolve the single schema for this record type (its natural handle, e.g. "patient") instead of listing \u2014 returns a one-element result, or empty if none. Combine with `surface=user|entity` for an identity schema. Takes precedence over userId. Optional.'
   )
 };
 var listSchemas = ({ client, log }) => ({
   name: "list_schemas",
   title: "List record schemas",
-  description: 'List the structured-record schema catalog for your tenant. Each schema describes a record type (e.g. "patient", "clinical_note") \u2014 its fields, lookup-indexed fields, and capabilities. Use this to discover what record types exist before calling `record_query`. Filter with `surface` (record/document/user/org/client \u2014 e.g. only document types), `recordType` (resolve one schema by its type name), or `userId`/`orgId`; default returns everything the credential can see.',
+  description: 'List the structured-record schema catalog for your tenant. Each schema describes a record type (e.g. "patient", "clinical_note") \u2014 its fields, lookup-indexed fields, and capabilities. Use this to discover what record types exist before calling `record_query`. Filter with `surface` (record/document/user/entity \u2014 e.g. only document types), `recordType` (resolve one schema by its type name), or `userId`/`scope`; default returns everything the credential can see.',
   inputSchema: inputSchema9,
   handler: async (args) => {
     const userId = args.userId;
-    const orgId = args.orgId;
+    const scope = args.scope;
     const surface = args.surface;
     const recordType = args.recordType;
     try {
       const schemas = await drainPages(
-        (startFrom) => client.schemas.listSchemas({ userId, orgId, surface, recordType, startFrom })
+        (startFrom) => client.schemas.listSchemas({ userId, scope, surface, recordType, startFrom })
       );
       log.debug(
-        { tool: "list_schemas", userId, orgId, surface, recordType, returned: schemas.length },
+        { tool: "list_schemas", userId, scope, surface, recordType, returned: schemas.length },
         "list_schemas ok"
       );
       return {
@@ -9801,7 +9609,7 @@ function isNotAvailable(err) {
 var documentGet = ({ client, log }) => ({
   name: "document_get",
   title: "Get document metadata (and optionally text)",
-  description: "Fetch metadata for a single document \u2014 select it by its Vectros `documentId` OR by your own `externalId` + `type` (resolved for you). Pass `includeText: true` to also fetch the text body (capped at ~8K tokens; `truncated: true` flag if cut). Text is available for every text-ingested document and for file-ingested documents unless they were uploaded with `storeText: false` (extracted text discarded after indexing) \u2014 then `textAvailable: false` is set; the original file is still retrievable via `includeDownloadUrl`. Pass `includeDownloadUrl: true` to also get a short-lived presigned `downloadUrl` for the original file (file-backed documents only). Returns the full document metadata, including its lifecycle `status` (ACTIVE, or ARCHIVED when soft-retracted from search \u2014 restorable via document_update) and its processing `indexStatus`.",
+  description: "Fetch metadata for a single document \u2014 select it by its Vectros `documentId` OR by your own `externalId` + `type` (resolved for you). Pass `includeText: true` to also fetch the text body (capped at ~8K tokens; `truncated: true` flag if cut). Text is available for every text-ingested document and for file-ingested documents unless they were uploaded with `storeText: false` (extracted text discarded after indexing) \u2014 then `textAvailable: false` is set; the original file is still retrievable via `includeDownloadUrl`. Pass `includeDownloadUrl: true` to also get a short-lived presigned `downloadUrl` for the original file (file-backed documents only). Returns the full document metadata, including its lifecycle `status` (ACTIVE, or ARCHIVED when soft-retracted from search \u2014 restorable via document_update) and its processing `indexStatus`. When `indexStatus` is FAILED the response also carries `indexFailure` with a machine-readable `code` telling you whether the content is still findable \u2014 e.g. TEXT_INDEX_FAILED / VECTOR_LIMIT_EXCEEDED (one leg still serves it) vs INDEXING_FAILED (not findable by search at all). Branch on `code`, not on the message.",
   inputSchema: inputSchema10,
   handler: async (args) => {
     const documentId = args.documentId;
@@ -9884,10 +9692,8 @@ var inputSchema11 = {
   // List-mode args:
   folderId: import_zod11.z.string().optional().describe("List mode: only documents in this folder (Vectros folder id)."),
   userId: import_zod11.z.string().optional().describe("List mode: scope to documents owned by this user."),
-  orgId: import_zod11.z.string().optional().describe("List mode: scope to documents belonging to this org."),
-  clientId: import_zod11.z.string().optional().describe("List mode: scope to documents associated with this client."),
   scope: import_zod11.z.string().optional().describe(
-    'List mode: filter to documents carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "group:eng-team"). `scope=org:<id>`/`scope=client:<id>` are equivalent to the orgId/clientId filters.'
+    'List mode: filter to documents carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
   ),
   startFrom: import_zod11.z.string().optional().describe("Pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next. Works in both list and lookup mode."),
   limit: import_zod11.z.number().int().min(1).max(MCP_MAX_LIMIT3).optional().describe(
@@ -9897,7 +9703,7 @@ var inputSchema11 = {
 var documentQuery = ({ client, log }) => ({
   name: "document_query",
   title: "Document query (list or lookup)",
-  description: "Query document metadata. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields (equality only there); range/prefix need a range-enabled field.\n  \u2022 List: omit `field`; optionally filter by `folderId`/`userId`/`orgId`/`clientId`/`scope`.\nReturns a `{ data, nextCursor }` page: `data` holds up to `limit` documents (default 3, max 100 \u2014 raise it in one call when you can accept the payload), and a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page. Mode is auto-detected. Use document_get for the full text/download URL of one document.",
+  description: "Query document metadata. Two modes:\n  \u2022 Lookup on a lookup-indexed field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Works on sensitive fields (equality only there); range/prefix need a range-enabled field.\n  \u2022 List: omit `field`; optionally filter by `folderId`/`userId`/`scope` (`namespace:value`).\nReturns a `{ data, nextCursor }` page: `data` holds up to `limit` documents (default 3, max 100 \u2014 raise it in one call when you can accept the payload), and a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page. Mode is auto-detected. Use document_get for the full text/download URL of one document.",
   inputSchema: inputSchema11,
   handler: async (args) => {
     const limit = args.limit ?? MCP_DEFAULT_LIMIT3;
@@ -9957,8 +9763,6 @@ var documentQuery = ({ client, log }) => ({
         page = await client.documents.listDocuments({
           folderId: args.folderId,
           userId: args.userId,
-          orgId: args.orgId,
-          clientId: args.clientId,
           scope: args.scope,
           startFrom,
           limit
@@ -9999,8 +9803,9 @@ var inputSchema12 = {
     "Lifecycle status. `ARCHIVED` soft-retracts the document \u2014 it is pulled from search and recall but kept and recoverable; set it back to `ACTIVE` to re-index and restore it. The way to retire superseded content when the credential has no delete authority. Omit to leave unchanged."
   ),
   userId: import_zod12.z.string().optional().describe("Reassign the owning user (Vectros UUID)."),
-  orgId: import_zod12.z.string().optional().describe("Reassign the owning org (Vectros UUID)."),
-  clientId: import_zod12.z.string().optional().describe("Reassign the associated client (Vectros UUID)."),
+  scopes: import_zod12.z.array(import_zod12.z.string()).optional().describe(
+    'Reassign scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]) \u2014 the COMPLETE new parent set. `org`/`client` are built-in namespaces. Omit to leave ownership unchanged; `[]` clears it (private to the owning user).'
+  ),
   expectedVersion: import_zod12.z.number().int().optional().describe(
     "Optimistic concurrency: the version you last read. If the document changed since, the update is refused as a conflict (re-read and retry). Omit for last-write-wins."
   )
@@ -10020,8 +9825,7 @@ var documentUpdate = ({ client, log }) => ({
     const folderId = args.folderId;
     const status = args.status;
     const userId = args.userId;
-    const orgId = args.orgId;
-    const clientId = args.clientId;
+    const scopes = args.scopes;
     const expectedVersion = args.expectedVersion;
     try {
       const resolved = await resolveDocumentIdByExternalId(client, { id: documentId, externalId, type });
@@ -10033,8 +9837,7 @@ var documentUpdate = ({ client, log }) => ({
       if (folderId !== void 0) body.folderId = folderId;
       if (status !== void 0) body.status = status;
       if (userId !== void 0) body.userId = userId;
-      if (orgId !== void 0) body.orgId = orgId;
-      if (clientId !== void 0) body.clientId = clientId;
+      if (scopes !== void 0) body.scopes = scopes;
       if (expectedVersion !== void 0) body.expectedVersion = expectedVersion;
       const updated = await client.documents.patchDocument({
         id: resolved.id,
@@ -10084,8 +9887,9 @@ var inputSchema14 = {
   id: import_zod14.z.string().optional().describe("Get mode: fetch this single folder by id."),
   parentId: import_zod14.z.string().optional().describe("List mode: direct children of this folder (tree navigation). Omit for a flat tenant list."),
   userId: import_zod14.z.string().optional().describe("List mode: scope to folders owned by this user."),
-  orgId: import_zod14.z.string().optional().describe("List mode: scope to folders belonging to this org."),
-  clientId: import_zod14.z.string().optional().describe("List mode: scope to folders associated with this client."),
+  scope: import_zod14.z.string().optional().describe(
+    'List mode: filter to folders carrying this scope value, in `namespace:value` form (e.g. "org:<uuid>", "client:<uuid>", "group:eng-team"). `org` and `client` are built-in namespaces; others are custom scopes you define.'
+  ),
   startFrom: import_zod14.z.string().optional().describe("List mode: pagination cursor \u2014 pass the `nextCursor` from the previous page to fetch the next."),
   limit: import_zod14.z.number().int().min(1).max(MCP_MAX_LIMIT4).optional().describe(
     `List mode: max folders per page. Default 10; raise up to ${MCP_MAX_LIMIT4} (the folders API max) in one call when you can accept the larger page, or page with \`startFrom\`.`
@@ -10094,7 +9898,7 @@ var inputSchema14 = {
 var folderQuery = ({ client, log }) => ({
   name: "folder_query",
   title: "Folder query (list or get)",
-  description: "Read folders. Two modes:\n  \u2022 Get: pass `id` \u2192 returns the single folder.\n  \u2022 List: omit `id`; pass `parentId` for a folder's direct children (tree navigation) or omit for a flat tenant list. Optionally filter by `userId`/`orgId`/`clientId`.\nList mode returns `{ data, nextCursor }` (default 10, max 100 per page \u2014 raise it in one call when you can accept the larger page); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page through all folders. Get mode returns the single folder object.",
+  description: "Read folders. Two modes:\n  \u2022 Get: pass `id` \u2192 returns the single folder.\n  \u2022 List: omit `id`; pass `parentId` for a folder's direct children (tree navigation) or omit for a flat tenant list. Optionally filter by `userId` or `scope` (`namespace:value`).\nList mode returns `{ data, nextCursor }` (default 10, max 100 per page \u2014 raise it in one call when you can accept the larger page); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom` to page through all folders. Get mode returns the single folder object.",
   inputSchema: inputSchema14,
   handler: async (args) => {
     const id = args.id;
@@ -10108,8 +9912,7 @@ var folderQuery = ({ client, log }) => ({
       const page = await client.folders.listFolders({
         parentFolderId: args.parentId,
         userId: args.userId,
-        orgId: args.orgId,
-        clientId: args.clientId,
+        scope: args.scope,
         startFrom: args.startFrom,
         limit
       });
@@ -10133,16 +9936,14 @@ var inputSchema15 = {
   parentId: import_zod15.z.string().optional().describe("Parent folder id \u2014 places the folder under this parent. Omit for the context default root. Create-only."),
   slug: import_zod15.z.string().optional().describe("Optional stable slug (sibling-unique; idempotency key). Lowercase letters/digits/hyphens. Derived from name when omitted."),
   userId: import_zod15.z.string().optional().describe("Owning user (Vectros UUID)."),
-  orgId: import_zod15.z.string().optional().describe("Owning org (Vectros UUID)."),
-  clientId: import_zod15.z.string().optional().describe("Associated client (Vectros UUID)."),
   scopes: import_zod15.z.array(import_zod15.z.string()).optional().describe(
-    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). This is the folder\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE folder owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default. `org:`/`client:` entries are equivalent to the orgId/clientId fields.'
+    'Scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the folder\'s COMPLETE scope declaration and values must come from the credential\'s own identity. An empty array `[]` creates a PRIVATE folder owned by the calling user alone. Omit to stamp the credential\'s full identity \u2014 the default.'
   )
 };
 var folderCreate = ({ client, log }) => ({
   name: "folder_create",
   title: "Create a folder",
-  description: "Create a folder to organize documents and records. Pass `parentId` to nest it (create-only \u2014 folders cannot be moved later). Idempotent by `slug` within the parent. Requires the key to allow folders:c.",
+  description: "Create a folder to organize documents and records. Pass `parentId` to nest it (create-only \u2014 folders cannot be moved later). Idempotent by `slug` within the parent. Requires the key to allow folders:c (and folders:r to receive the existing folder on a collision).",
   inputSchema: inputSchema15,
   handler: async (args) => {
     try {
@@ -10153,8 +9954,6 @@ var folderCreate = ({ client, log }) => ({
           parentFolderId: args.parentId,
           slug: args.slug,
           userId: args.userId,
-          orgId: args.orgId,
-          clientId: args.clientId,
           scopes: args.scopes
         }
       });
@@ -10175,8 +9974,9 @@ var inputSchema16 = {
   name: import_zod16.z.string().optional().describe("New folder name. Omit to keep the current name."),
   description: import_zod16.z.string().optional().describe("New description. Omit to leave unchanged."),
   userId: import_zod16.z.string().optional().describe("Reassign the owning user (Vectros UUID)."),
-  orgId: import_zod16.z.string().optional().describe("Reassign the owning org (Vectros UUID)."),
-  clientId: import_zod16.z.string().optional().describe("Reassign the associated client (Vectros UUID)."),
+  scopes: import_zod16.z.array(import_zod16.z.string()).optional().describe(
+    'Reassign scope ownership as `namespace:value` entries, at most 2 (e.g. ["org:<uuid>", "group:eng-team"]) \u2014 the COMPLETE new parent set. `org`/`client` are built-in namespaces. Omit to leave ownership unchanged; `[]` clears it (private to the owning user).'
+  ),
   expectedVersion: import_zod16.z.number().int().optional().describe(
     "Optimistic concurrency: the version you last read. If the folder changed since, the update is refused as a conflict (re-read and retry). Omit for last-write-wins."
   )
@@ -10191,16 +9991,14 @@ var folderUpdate = ({ client, log }) => ({
     const name = args.name;
     const description = args.description;
     const userId = args.userId;
-    const orgId = args.orgId;
-    const clientId = args.clientId;
+    const scopes = args.scopes;
     const expectedVersion = args.expectedVersion;
     try {
       const body = {};
       if (name !== void 0) body.name = name;
       if (description !== void 0) body.description = description;
       if (userId !== void 0) body.userId = userId;
-      if (orgId !== void 0) body.orgId = orgId;
-      if (clientId !== void 0) body.clientId = clientId;
+      if (scopes !== void 0) body.scopes = scopes;
       if (expectedVersion !== void 0) body.expectedVersion = expectedVersion;
       const updated = await client.folders.patchFolder({ id, body });
       log.debug({ tool: "folder_update", id }, "folder_update ok");
@@ -10244,7 +10042,7 @@ var inputSchema18 = {
 var currentIdentity = ({ log, apiKey, environment }) => ({
   name: "current_identity",
   title: "Current identity (tenant + principal scope)",
-  description: "Describe the credential the MCP server is operating under. Returns tenantId, environment (staging|production), principalType (root_key|scoped_key|token), principalKeyId, and (for scoped keys) allowedActions + dataScope. Use this when the user asks 'what can you do here?' or 'what tenant am I in?'. Calls GET /v1/ping under the hood. Backend may still be rolling out the extended /v1/ping response shape \u2014 until then this tool returns a minimal shape; richer fields appear automatically as backend ships.",
+  description: "Describe the credential the MCP server is operating under. Returns tenantId, environment (staging|production), principalType (root_key|scoped_key|token), principalKeyId, principalLabel, and (for scoped credentials) allowedActions plus dataScope \u2014 the credential's reach as { userId, scopes[] }, where each scope is a `namespace:value` string (e.g. \"org:<uuid>\"). Use this when the user asks 'what can you do here?' or 'what tenant am I in?'. Calls GET /v1/ping under the hood.",
   inputSchema: inputSchema18,
   handler: async () => {
     try {
@@ -10342,7 +10140,7 @@ var inputSchema19 = {
     "Index strategy. HYBRID (BM25 + dense, default; best for general retrieval), SEMANTIC (dense only; concept-driven queries), TEXT (BM25 only; exact-match / keyword), NONE (store-only / archival \u2014 retrievable by id and structured-field lookup but never in search results). Omit to inherit the bound schema's default."
   ),
   externalId: import_zod18.z.string().optional().describe(
-    "Stable caller-supplied id. Immutable; unique per type within your context. Re-ingesting with the same externalId returns the existing document (idempotent) instead of creating a duplicate \u2014 use it to make ingests safely retryable and as the key other records reference. Mirrors record_create."
+    'Stable caller-supplied id. Immutable; unique per type within your context. Re-ingesting with the same externalId returns the existing document (idempotent) instead of creating a duplicate \u2014 use it to make ingests safely retryable and as the key other records reference. Mirrors record_create. Receiving the existing document back is a read of it and needs documents:r in addition to documents:c; a create-only key gets an "already exists" error instead of the document.'
   ),
   upsert: import_zod18.z.boolean().optional().describe(
     "When true, re-ingesting an existing externalId OVERWRITES that document and re-indexes the new body (text mode) / re-uploads and re-indexes the new file (file mode), instead of returning the existing one unchanged. This is the curation/re-sync primitive: edit a source, re-ingest with upsert:true, and the search index reflects the new content. Requires the documents:u scope. IMPORTANT: pass the SAME schemaId (and type) you used originally \u2014 externalId is unique WITHIN a type, so omitting schemaId resolves in the untyped namespace and mints a duplicate instead of updating. The response `created` flag confirms which happened (created:true = a new document was minted)."
@@ -10351,12 +10149,12 @@ var inputSchema19 = {
     "Bind this document to a record schema. When set, `payload` is validated against the schema and its lookup fields become directly queryable via document_query (records parity). Resolve a schema id from its type via list_schemas. Omit for an untyped document."
   ),
   payload: import_zod18.z.record(import_zod18.z.string(), import_zod18.z.unknown()).optional().describe(
-    "The document's structured data \u2014 a flat key/value object. With `schemaId`, declared fields are validated and lookup fields indexed; undeclared keys pass through as free-form and are searchable via the hybrid_search `filters` param. Without a schema it is stored as free-form metadata."
+    "The document's structured data \u2014 a flat key/value object. With `schemaId`, declared fields are validated and lookup fields indexed; undeclared keys pass through as free-form and are searchable via the hybrid_search `filters` param. Without a schema it is stored as free-form metadata. Every number must fall within the signed 64-bit range \u2014 send a larger whole number as a STRING (stored exactly, exact-match lookup), else the ingest is refused with a 400 naming the field."
   ),
   // Inline text mode (mutually exclusive with filePath):
   text: import_zod18.z.string().min(1).optional().describe("Text body to ingest inline. Mutually exclusive with filePath. Either text or filePath is required."),
   storeText: import_zod18.z.boolean().optional().describe(
-    "Whether the document's text is retained after indexing (default true). Applies to BOTH modes and is fixed at ingest time. Text mode: the ingested body is always retained (this flag is effectively always true \u2014 the body is the document). File mode: true keeps the extracted text retrievable via document_get(includeText:true) and usable by document_ask; false discards the extracted text once indexing completes \u2014 search still works and the original file remains downloadable, but includeText returns textAvailable:false and document_ask is unavailable."
+    "FILE MODE ONLY. Whether the uploaded file's EXTRACTED text is retained after indexing (default true), fixed at ingest. true keeps the extracted text retrievable via document_get(includeText:true) and usable by document_ask; false discards it once indexing completes \u2014 search still works and the original file remains downloadable, but includeText returns textAvailable:false and document_ask is unavailable. NOT accepted with `text`: a text-ingested body is the document itself and is ALWAYS retained, so the backend has no storeText knob on the text path \u2014 passing it with `text` is rejected rather than silently ignored."
   ),
   // File upload mode (mutually exclusive with text; stdio-transport-only):
   filePath: import_zod18.z.string().min(1).optional().describe(
@@ -10366,16 +10164,14 @@ var inputSchema19 = {
   // Common (both modes):
   folderId: import_zod18.z.string().optional().describe("Optional folder to ingest into. Default: tenant root."),
   userId: import_zod18.z.string().optional().describe("Owning user ID. Optional."),
-  orgId: import_zod18.z.string().optional().describe("Owning org ID. Optional."),
-  clientId: import_zod18.z.string().optional().describe("Owning client ID. Optional."),
   scopes: import_zod18.z.array(import_zod18.z.string()).optional().describe(
-    "TEXT MODE ONLY. Scope ownership as `namespace:value` entries, at most 2 (e.g. [\"org:<uuid>\", \"group:eng-team\"]). This is the document's COMPLETE scope declaration and values must come from the credential's own identity. An empty array `[]` creates a PRIVATE document owned by the calling user alone. Omit to stamp the credential's full identity \u2014 the default. `org:`/`client:` entries are equivalent to the orgId/clientId fields. Rejected with `filePath` (file uploads do not accept a scope declaration): a file-uploaded document is stamped with the credential's full identity."
+    "TEXT MODE ONLY. Scope ownership as `namespace:value` entries, at most 2 (e.g. [\"org:<uuid>\", \"group:eng-team\"]). `org` and `client` are built-in namespaces; others are custom scopes you define. This is the document's COMPLETE scope declaration and values must come from the credential's own identity. An empty array `[]` creates a PRIVATE document owned by the calling user alone. Omit to stamp the credential's full identity \u2014 the default. Rejected with `filePath` (file uploads do not accept a scope declaration): a file-uploaded document is stamped with the credential's full identity."
   )
 };
 var documentIngest = ({ client, log, transport, ingestRoot }) => ({
   name: "document_ingest",
   title: "Ingest a new document (text body or file upload)",
-  description: "Create a new document in your Vectros tenant. Two modes:\n  \u2022 Text mode: pass `text` (string body). Single-call. Use for crawled content, notes, generated text.\n  \u2022 File mode: pass `filePath` (local path on the MCP server's host machine). STDIO-TRANSPORT ONLY \u2014 rejected on HTTP transport. MCP server reads the bytes, requests a presigned upload URL, and PUTs them. Returns when the upload is accepted (indexStatus: PENDING_INDEX); poll with `document_get` until indexStatus is INDEXED.\nEither `text` or `filePath` must be present; both is an error. Idempotent by `externalId` (re-ingest returns the existing document, not a duplicate). To UPDATE an existing document instead \u2014 re-index an edited body \u2014 pass `upsert:true` with the same `externalId` (and the same `schemaId`); this is the re-sync primitive for keeping a knowledge base current. Pass `schemaId` + `payload` for a typed, lookup-queryable document (records parity). indexMode defaults to HYBRID for untyped documents (omit to inherit a bound schema's default). storeText defaults to true and is fixed at ingest: in file mode, false discards the extracted text after indexing (search + file download keep working; text retrieval and document_ask do not). Text-mode bodies are always retained.",
+  description: "Create a new document in your Vectros tenant. Two modes:\n  \u2022 Text mode: pass `text` (string body). Single-call. Use for crawled content, notes, generated text.\n  \u2022 File mode: pass `filePath` (local path on the MCP server's host machine). STDIO-TRANSPORT ONLY \u2014 rejected on HTTP transport. MCP server reads the bytes, requests a presigned upload URL, and PUTs them. Returns when the upload is accepted (indexStatus: PENDING_INDEX); poll with `document_get` until indexStatus is INDEXED.\nEither `text` or `filePath` must be present; both is an error. Idempotent by `externalId` (re-ingest returns the existing document, not a duplicate \u2014 requires documents:r in addition to documents:c, since being handed the existing document is a read of it). To UPDATE an existing document instead \u2014 re-index an edited body \u2014 pass `upsert:true` with the same `externalId` (and the same `schemaId`); this is the re-sync primitive for keeping a knowledge base current. Pass `schemaId` + `payload` for a typed, lookup-queryable document (records parity). indexMode defaults to HYBRID for untyped documents (omit to inherit a bound schema's default). storeText is a FILE-MODE knob (default true): false discards the uploaded file's extracted text after indexing (search + file download keep working; text retrieval and document_ask do not). Text-mode bodies are always retained, so storeText is not accepted with `text`.",
   inputSchema: inputSchema19,
   handler: async (args) => {
     const title = args.title;
@@ -10412,14 +10208,20 @@ var documentIngest = ({ client, log, transport, ingestRoot }) => ({
         )
       );
     }
+    if (text && args.storeText !== void 0) {
+      return toolError(
+        "document_ingest",
+        new Error(
+          "`storeText` is not supported with `text` \u2014 a text-ingested body is the document itself and is always retained; the text path has no storeText control. Omit it (text mode), or use `filePath` mode where storeText:false discards the uploaded file's extracted text after indexing."
+        )
+      );
+    }
     const common = {
       folderId: args.folderId,
       payload: args.payload,
       schemaId,
       externalId: args.externalId,
-      userId: args.userId,
-      orgId: args.orgId,
-      clientId: args.clientId
+      userId: args.userId
     };
     try {
       if (text) {
@@ -10526,7 +10328,9 @@ var import_zod19 = require("zod");
 var MCP_DEFAULT_LIMIT5 = 10;
 var MCP_MAX_LIMIT5 = 100;
 var inputSchema20 = {
-  kind: import_zod19.z.enum(["user", "org", "client"]).describe("Which principal to look up: a user, an organization, or a client."),
+  kind: import_zod19.z.string().describe(
+    'Which principal to look up: "user" (the fixed principal surface), or an entity namespace \u2014 "org", "client" (built in), or a namespace you registered.'
+  ),
   externalId: import_zod19.z.string().optional().describe(
     "Resolve mode: your own stable identifier for the principal. Returns the single matching principal (with its Vectros UUID), or an empty array if none. The fastest path to the UUID the ownership filters need. Takes precedence if both this and a `field` lookup are supplied."
   ),
@@ -10545,11 +10349,12 @@ var inputSchema20 = {
 };
 var lookupPrincipal = ({ client, log }) => ({
   name: "lookup_principal",
-  title: "Look up a user / org / client identity",
-  description: "Resolve a user, org, or client identity. Two modes:\n  \u2022 Resolve by your own id: pass `externalId` \u2192 the matching principal incl. its Vectros UUID (the id the ownership filters on record_query / hybrid_search / rag_ask expect).\n  \u2022 Lookup by a schema field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Sensitive-field-safe. (If both `externalId` and a `field` lookup are given, `externalId` wins.) Returns a `{ data, nextCursor }` page (default 10, max 100 \u2014 raise it in one call when you can accept the payload); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom`. Read-only \u2014 does not create or modify identities.",
+  title: "Look up a user identity or a namespaced identity entity",
+  description: "Resolve a user, or an identity entity in a namespace (org/client/one you registered). Two modes:\n  \u2022 Resolve by your own id: pass `externalId` \u2192 the matching principal incl. its Vectros UUID (the id the ownership filters on record_query / hybrid_search / rag_ask expect).\n  \u2022 Lookup by a schema field: pass `type` and `field` plus exactly one of `value` (exact), `from`+`to` (range), or `prefix`. Sensitive-field-safe. (If both `externalId` and a `field` lookup are given, `externalId` wins.) Returns a `{ data, nextCursor }` page (default 10, max 100 \u2014 raise it in one call when you can accept the payload); a non-null `nextCursor` means more remain \u2014 pass it back as `startFrom`. Read-only \u2014 does not create or modify identities.",
   inputSchema: inputSchema20,
   handler: async (args) => {
     const kind = args.kind;
+    const isUser = kind === "user";
     const limit = args.limit ?? MCP_DEFAULT_LIMIT5;
     const externalId = args.externalId;
     const type = args.type;
@@ -10563,13 +10368,7 @@ var lookupPrincipal = ({ client, log }) => ({
     try {
       let page;
       if (externalId !== void 0) {
-        if (kind === "user") {
-          page = await client.identity.listUsers({ externalId, limit });
-        } else if (kind === "org") {
-          page = await client.identity.listOrgs({ externalId, limit });
-        } else {
-          page = await client.identity.listClients({ externalId, limit });
-        }
+        page = isUser ? await client.identity.listUsers({ externalId, limit }) : await client.identity.listEntities({ namespace: kind, externalId, limit });
         log.debug({ tool: "lookup_principal", mode: "resolve", kind }, "lookup_principal resolve ok");
       } else if (field !== void 0) {
         const hasEquality = value !== void 0;
@@ -10598,13 +10397,7 @@ var lookupPrincipal = ({ client, log }) => ({
           );
         }
         const req = { type, field, value, from, to, prefix, order, startFrom, limit };
-        if (kind === "user") {
-          page = await client.identity.lookupUsers(req);
-        } else if (kind === "org") {
-          page = await client.identity.lookupOrgs(req);
-        } else {
-          page = await client.identity.lookupClients(req);
-        }
+        page = isUser ? await client.identity.lookupUsers(req) : await client.identity.lookupEntities({ namespace: kind, body: req });
         log.debug({ tool: "lookup_principal", mode: "lookup", kind, type, field }, "lookup_principal lookup ok");
       } else {
         return toolError(
@@ -10727,7 +10520,7 @@ var identityResource = ({ log, apiKey, environment }) => ({
   name: "identity",
   uri: "vectros://identity",
   title: "Current identity (tenant + principal scope)",
-  description: "The tenant + principal scope the MCP server is authenticated as. Returns the same payload as the `current_identity` tool: status, environment, principalType, principalKeyId, and (for scoped keys) allowedActions + dataScope. Until backend ships the extended /v1/ping response, returns a minimal derived shape; richer fields appear automatically as backend rolls out.",
+  description: "The tenant + principal scope the MCP server is authenticated as. Returns the same payload as the `current_identity` tool: status, tenantId, environment, principalType, principalKeyId, principalLabel, and (for scoped credentials) allowedActions + dataScope ({ userId, scopes[] }). The /v1/ping backing call ships this extended shape today.",
   mimeType: "application/json",
   read: async () => {
     const identity = await resolveIdentity({ log, apiKey, environment });
@@ -11196,10 +10989,144 @@ function parseToolsEnv(value) {
   return requested;
 }
 
+// src/resolve-key.ts
+var import_node_child_process = require("child_process");
+var import_node_fs = require("fs");
+var import_node_path2 = __toESM(require("path"));
+var HELPER_COMMAND = "vectros";
+var HELPER_TIMEOUT_MS = 1e4;
+var HELPER_MAX_BUFFER = 64 * 1024;
+var ALIAS_RE = /^[A-Za-z0-9._-]+$/;
+var SECRET_RE = /(?:ssk|sk|st)_(?:live|test)_[A-Za-z0-9._-]+/gi;
+var DETAIL_MAX_CHARS = 200;
+async function resolveApiKey(deps = {}) {
+  const env = deps.env ?? process.env;
+  const envKey = env.VECTROS_API_KEY;
+  if (envKey && envKey.trim().length > 0) {
+    return { key: envKey.trim(), source: "env" };
+  }
+  const alias = env.VECTROS_KEYRING_ALIAS?.trim() || void 0;
+  if (alias !== void 0 && !ALIAS_RE.test(alias)) {
+    return {
+      source: "none",
+      reason: "bad-alias",
+      detail: "VECTROS_KEYRING_ALIAS must be letters, digits, dot, dash, or underscore."
+    };
+  }
+  const runHelper = deps.runHelper ?? defaultRunHelper;
+  const outcome = await runHelper({ alias, env });
+  switch (outcome.status) {
+    case "ok":
+      return { key: outcome.secret, source: "keyring", alias };
+    case "cli-absent":
+      return { source: "none", reason: "cli-absent", alias };
+    // Redact HERE as well as in mapExecResult: `runHelper` is a public injectable
+    // seam, so redacting only inside the default implementation would leave any
+    // other implementation's text to reach the fatal log raw. Belongs at the sink.
+    case "no-usable-key":
+      return {
+        source: "none",
+        reason: "no-usable-key",
+        alias,
+        detail: outcome.detail ? redactDetail(outcome.detail) : void 0
+      };
+    case "error":
+      return { source: "none", reason: "helper-failed", alias, detail: redactDetail(outcome.detail) };
+  }
+}
+function noKeyMessage(resolved) {
+  const setEnv = "set VECTROS_API_KEY to a Vectros key (recommended: ssk_live_\u2026)";
+  switch (resolved.reason) {
+    case "cli-absent":
+      return `no API key: VECTROS_API_KEY is unset and the \`vectros\` CLI is not on PATH. Either ${setEnv}, or install @vectros-ai/cli and run \`vectros switch <alias>\`.`;
+    case "no-usable-key":
+      return `no API key: VECTROS_API_KEY is unset and \`vectros keyring show\` returned no key${resolved.detail ? ` \u2014 ${resolved.detail}` : ""}. Run \`vectros switch <alias>\` to pick an identity, \`vectros keyring doctor\` to inspect the keyring (CLI 0.10.0+), upgrade @vectros-ai/cli if it predates the keyring (0.9.0), or ${setEnv}.`;
+    case "bad-alias":
+      return `invalid VECTROS_KEYRING_ALIAS: ${resolved.detail ?? "not a valid keyring alias"} Run \`vectros keyring list\` to see the entry names, unset it to use the active identity, or ${setEnv}.`;
+    case "helper-failed":
+      return `no API key: VECTROS_API_KEY is unset and the \`vectros keyring show\` helper failed (${resolved.detail ?? "unknown error"}). Upgrade @vectros-ai/cli if it is an old build, or ${setEnv} to bypass the keyring.`;
+    default:
+      return `no API key: ${setEnv}.`;
+  }
+}
+function keyringNotice(resolved) {
+  if (resolved.source !== "keyring") return void 0;
+  if (resolved.alias !== void 0) {
+    return { level: "info", alias: resolved.alias, message: "resolved API key from the vectros CLI keyring" };
+  }
+  return {
+    level: "warn",
+    alias: "(active)",
+    message: "resolved API key from the vectros CLI keyring: no entry was named, so this server is running as whatever identity `vectros switch` last made active. Set VECTROS_API_KEY, or VECTROS_KEYRING_ALIAS, to choose deliberately \u2014 `vectros keyring doctor` shows which entry is active and whether it holds a live key."
+  };
+}
+function redactDetail(message) {
+  const redacted = message.replace(/\s+/g, " ").trim().replace(SECRET_RE, "[redacted]");
+  return redacted.length > DETAIL_MAX_CHARS ? `${redacted.slice(0, DETAIL_MAX_CHARS)}\u2026` : redacted;
+}
+function resolveCommandPath(command, env, platform = process.platform) {
+  const pathVar = env.PATH ?? env.Path ?? env.path ?? "";
+  if (!pathVar) return void 0;
+  const exts = platform === "win32" ? (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.trim()).filter(Boolean) : [""];
+  for (const rawDir of pathVar.split(import_node_path2.default.delimiter)) {
+    const dir = rawDir.trim().replace(/^"(.*)"$/, "$1");
+    if (!dir || !import_node_path2.default.isAbsolute(dir)) continue;
+    for (const ext of exts) {
+      const candidate = import_node_path2.default.join(dir, command + ext);
+      try {
+        if ((0, import_node_fs.statSync)(candidate).isFile()) return candidate;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+function mapExecResult(err, stdout, stderr = "") {
+  if (!err) {
+    const secret = stdout.trim();
+    return secret ? { status: "ok", secret } : { status: "no-usable-key" };
+  }
+  const code = err.code;
+  if (code === "ENOENT") return { status: "cli-absent" };
+  const detail = redactDetail(stderr.trim() || err.message);
+  if (code === 1 || code === 2) return { status: "no-usable-key", detail: detail || void 0 };
+  return { status: "error", detail };
+}
+function defaultRunHelper({ alias, env }, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const exec = deps.execFileImpl ?? import_node_child_process.execFile;
+  const resolved = resolveCommandPath(HELPER_COMMAND, env, platform);
+  if (!resolved) return Promise.resolve({ status: "cli-absent" });
+  const isWindows = platform === "win32";
+  const args = ["keyring", "show", "--format", "raw", ...alias ? ["--alias", alias] : []];
+  const file = isWindows ? `"${resolved}"` : resolved;
+  return new Promise((resolve2) => {
+    exec(
+      file,
+      args,
+      {
+        env,
+        timeout: HELPER_TIMEOUT_MS,
+        maxBuffer: HELPER_MAX_BUFFER,
+        windowsHide: true,
+        shell: isWindows
+      },
+      (err, stdout, stderr) => resolve2(mapExecResult(err, String(stdout ?? ""), String(stderr ?? "")))
+    );
+  });
+}
+
 // src/cli-http.ts
 async function main() {
   const log = createLogger2();
-  const apiKey = process.env.VECTROS_API_KEY;
+  const resolved = await resolveApiKey();
+  const apiKey = resolved.key;
+  const notice = keyringNotice(resolved);
+  if (notice) log[notice.level]({ alias: notice.alias }, notice.message);
+  if (!apiKey) {
+    log.fatal({ reason: resolved.reason }, noKeyMessage(resolved));
+    process.exit(1);
+  }
   const apiBaseUrl = process.env.VECTROS_API_BASE_URL;
   if (apiBaseUrl !== void 0) {
     try {