@elevasis/sdk 1.22.0 → 1.23.0

package/dist/index.js

@@ -68,6 +68,7 @@ var ORGANIZATION_MODEL_ICON_TOKENS = [
   "crm",
   "lead-gen",
   "projects",
+  "clients",
   "operations",
   "monitoring",
   "knowledge",
@@ -895,7 +896,6 @@ function addLegacyEntityProjections(index, diagnostics, sourcesById, entities) {
           table: entity.table
         }
       } : {},
-      legacyEntityId: entity.id,
       ...entity.rowSchema !== void 0 ? { rowSchema: entity.rowSchema } : {},
       ...entity.stateCatalogId !== void 0 ? { stateCatalogId: entity.stateCatalogId } : {}
     };
@@ -920,8 +920,7 @@ function addLegacyEntityProjections(index, diagnostics, sourcesById, entities) {
         from: legacyObjectId(entity),
         to: legacyObjectId(targetEntity),
         cardinality: link.kind,
-        ...link.via !== void 0 ? { via: link.via } : {},
-        legacyEntityId: entity.id
+        ...link.via !== void 0 ? { via: link.via } : {}
       };
       addRecord(index, diagnostics, sourcesById, "linkTypes", linkType, {
         source: "legacy.entities.links",
@@ -979,8 +978,7 @@ function addSystemContentProjections(index, diagnostics, sourcesById, systemPath
       kind: node.type,
       ...typeof node.data?.["entityId"] === "string" ? { appliesTo: formatOntologyId({ scope: systemPath, kind: "object", localId: node.data["entityId"] }) } : {},
       ...Object.keys(entries).length > 0 ? { entries } : {},
-      ...node.data !== void 0 ? { data: node.data } : {},
-      legacyContentId: `${systemPath}:${localId}`
+      ...node.data !== void 0 ? { data: node.data } : {}
     };
     addRecord(index, diagnostics, sourcesById, "catalogTypes", catalogType, {
       source: "legacy.system.content",
@@ -1535,11 +1533,20 @@ EventEmissionDescriptorSchema.extend({
   ownerKind: z.enum(["resource", "entity"]).meta({ label: "Owner kind" })
 });
 var ResourceOntologyBindingSchema = z.object({
-  implements: z.array(OntologyIdSchema).optional(),
+  actions: z.array(OntologyIdSchema).optional(),
+  primaryAction: OntologyIdSchema.optional(),
   reads: z.array(OntologyIdSchema).optional(),
   writes: z.array(OntologyIdSchema).optional(),
   usesCatalogs: z.array(OntologyIdSchema).optional(),
   emits: z.array(OntologyIdSchema).optional()
+}).superRefine((binding, ctx) => {
+  if (binding.primaryAction === void 0) return;
+  if (binding.actions?.includes(binding.primaryAction)) return;
+  ctx.addIssue({
+    code: z.ZodIssueCode.custom,
+    path: ["primaryAction"],
+    message: "Resource ontology primaryAction must be included in actions"
+  });
 });
 var CodeReferenceSchema = z.object({
   path: z.string().trim().min(1).max(500).regex(/^[A-Za-z0-9_./$@()[\] -]+$/, "Code reference paths must be repo-relative paths"),
@@ -1554,6 +1561,10 @@ var ResourceEntryBaseSchema = z.object({
   order: z.number().default(0),
   /** Required single System membership — value is a dot-separated system path (e.g. "sales.lead-gen"). */
   systemPath: SystemPathSchema.meta({ ref: "system" }),
+  /** Executable display title owned by the OM Resource descriptor. */
+  title: LabelSchema.optional(),
+  /** Executable display description owned by the OM Resource descriptor. */
+  description: DescriptionSchema.optional(),
   /** Optional role responsible for maintaining this resource. */
   ownerRoleId: ModelIdSchema.meta({ ref: "role" }).optional(),
   status: ResourceGovernanceStatusSchema,
@@ -1568,8 +1579,6 @@ var ResourceEntryBaseSchema = z.object({
 });
 var WorkflowResourceEntrySchema = ResourceEntryBaseSchema.extend({
   kind: z.literal("workflow"),
-  /** Mirrors WorkflowConfig.actionKey when the runtime workflow has one. */
-  actionKey: z.string().trim().min(1).max(255).optional(),
   emits: z.array(EventEmissionDescriptorSchema).optional()
 });
 var AgentResourceEntrySchema = ResourceEntryBaseSchema.extend({
@@ -1609,6 +1618,30 @@ var ResourcesDomainSchema = z.record(z.string(), ResourceEntrySchema).refine((re
   message: "Each resource entry id must match its map key"
 }).default({});
 var DEFAULT_ORGANIZATION_MODEL_RESOURCES = {};
+function defineResource(resource) {
+  return ResourceEntrySchema.parse(resource);
+}
+function defineResources(resources) {
+  return Object.fromEntries(
+    Object.entries(resources).map(([key, resource]) => [key, ResourceEntrySchema.parse(resource)])
+  );
+}
+function ontologyIdFrom(input) {
+  return typeof input === "string" ? input : input.id;
+}
+function ontologyIdArrayFrom(input) {
+  return input?.map(ontologyIdFrom);
+}
+function defineResourceOntology(input) {
+  return ResourceOntologyBindingSchema.parse({
+    actions: ontologyIdArrayFrom(input.actions),
+    primaryAction: input.primaryAction === void 0 ? void 0 : ontologyIdFrom(input.primaryAction),
+    reads: ontologyIdArrayFrom(input.reads),
+    writes: ontologyIdArrayFrom(input.writes),
+    usesCatalogs: ontologyIdArrayFrom(input.usesCatalogs),
+    emits: ontologyIdArrayFrom(input.emits)
+  });
+}
 
 // ../core/src/organization-model/domains/roles.ts
 var RoleIdSchema = ModelIdSchema;
@@ -1789,6 +1822,170 @@ var OrgKnowledgeNodeSchema = z.object({
   updatedAt: z.string().trim().min(1).max(50)
 });
 var KnowledgeDomainSchema = z.record(ModelIdSchema, OrgKnowledgeNodeSchema).default({});
+var SecretLikeMetadataKeySchema = /(?:secret|password|passwd|token|api[-_]?key|credential|private[-_]?key)/i;
+var SecretLikeMetadataValueSchema = /(?:sk-[A-Za-z0-9_-]{12,}|pk_live_[A-Za-z0-9_-]{12,}|eyJ[A-Za-z0-9_-]{20,}|-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----)/;
+var OmTopologyNodeKindSchema = z.enum([
+  "system",
+  "resource",
+  "ontology",
+  "policy",
+  "role",
+  "trigger",
+  "humanCheckpoint",
+  "externalResource"
+]);
+var OmTopologyRelationshipKindSchema = z.enum(["triggers", "uses", "approval"]);
+var OmTopologyNodeRefSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("system"), id: ModelIdSchema }),
+  z.object({ kind: z.literal("resource"), id: ResourceIdSchema }),
+  z.object({ kind: z.literal("ontology"), id: OntologyIdSchema }),
+  z.object({ kind: z.literal("policy"), id: ModelIdSchema }),
+  z.object({ kind: z.literal("role"), id: ModelIdSchema }),
+  z.object({ kind: z.literal("trigger"), id: ResourceIdSchema }),
+  z.object({ kind: z.literal("humanCheckpoint"), id: ResourceIdSchema }),
+  z.object({ kind: z.literal("externalResource"), id: ResourceIdSchema })
+]);
+var OmTopologyMetadataSchema = z.record(z.string().trim().min(1).max(120), JsonValueSchema).superRefine((metadata, ctx) => {
+  function visit(value, path) {
+    if (typeof value === "string" && SecretLikeMetadataValueSchema.test(value)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path,
+        message: "Topology metadata must not contain secret-like values"
+      });
+      return;
+    }
+    if (Array.isArray(value)) {
+      value.forEach((entry, index) => visit(entry, [...path, index]));
+      return;
+    }
+    if (typeof value !== "object" || value === null) return;
+    Object.entries(value).forEach(([key, entry]) => {
+      if (SecretLikeMetadataKeySchema.test(key)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [...path, key],
+          message: `Topology metadata key "${key}" looks secret-like`
+        });
+      }
+      visit(entry, [...path, key]);
+    });
+  }
+  visit(metadata, []);
+});
+var OmTopologyRelationshipSchema = z.object({
+  from: OmTopologyNodeRefSchema,
+  kind: OmTopologyRelationshipKindSchema,
+  to: OmTopologyNodeRefSchema,
+  systemPath: SystemPathSchema.optional(),
+  required: z.boolean().optional(),
+  metadata: OmTopologyMetadataSchema.optional()
+});
+var OmTopologyDomainSchema = z.object({
+  version: z.literal(1).default(1),
+  relationships: z.record(z.string().trim().min(1).max(255), OmTopologyRelationshipSchema).default({})
+}).default({ version: 1, relationships: {} });
+var DEFAULT_ORGANIZATION_MODEL_TOPOLOGY = {
+  version: 1,
+  relationships: {}
+};
+function idFrom(input) {
+  return typeof input === "string" ? input : input.id;
+}
+function parseRef(kind, id) {
+  return OmTopologyNodeRefSchema.parse({ kind, id });
+}
+function isNodeRef(input) {
+  return OmTopologyNodeRefSchema.safeParse(input).success;
+}
+function isResourceEntry(input) {
+  if (typeof input !== "object" || input === null) return false;
+  const candidate = input;
+  return typeof candidate.id === "string" && typeof candidate.systemPath === "string" && typeof candidate.status === "string" && ["workflow", "agent", "integration", "script"].includes(String(candidate.kind));
+}
+var topologyRef = {
+  system: (system) => parseRef("system", idFrom(system)),
+  resource: (resource) => parseRef("resource", idFrom(resource)),
+  ontology: (record) => parseRef("ontology", idFrom(record)),
+  policy: (policy) => parseRef("policy", idFrom(policy)),
+  role: (role) => parseRef("role", idFrom(role)),
+  trigger: (trigger) => parseRef("trigger", idFrom(trigger)),
+  humanCheckpoint: (checkpoint) => parseRef("humanCheckpoint", idFrom(checkpoint)),
+  externalResource: (externalResource) => parseRef("externalResource", idFrom(externalResource))
+};
+var topologyRelationship = {
+  triggers: (from, to, options = {}) => defineTopologyRelationship({
+    ...options,
+    from,
+    kind: "triggers",
+    to
+  }),
+  uses: (from, to, options = {}) => defineTopologyRelationship({
+    ...options,
+    from,
+    kind: "uses",
+    to
+  }),
+  approval: (from, to, options = {}) => defineTopologyRelationship({
+    ...options,
+    from,
+    kind: "approval",
+    to
+  }),
+  usesIntegration: (from, integration, options = {}) => defineTopologyRelationship({
+    required: true,
+    ...options,
+    from,
+    kind: "uses",
+    to: integration
+  }),
+  requestsApproval: (from, checkpoint, options = {}) => defineTopologyRelationship({
+    required: true,
+    ...options,
+    from,
+    kind: "approval",
+    to: topologyRef.humanCheckpoint(checkpoint)
+  }),
+  checkpointRoutesTo: (checkpoint, to, options = {}) => defineTopologyRelationship({
+    required: true,
+    ...options,
+    from: topologyRef.humanCheckpoint(checkpoint),
+    kind: "triggers",
+    to
+  })
+};
+function compileTopologyNodeRef(input) {
+  if (isNodeRef(input)) return input;
+  if (isResourceEntry(input)) return topologyRef.resource(input);
+  throw new Error("Topology node refs must be typed node objects or serializable { kind, id } refs");
+}
+function parseTopologyNodeRef(input) {
+  if (typeof input !== "string") return OmTopologyNodeRefSchema.parse(input);
+  const separatorIndex = input.indexOf(":");
+  if (separatorIndex === -1) {
+    throw new Error(`Topology node ref "${input}" must use <kind>:<id>`);
+  }
+  const kind = input.slice(0, separatorIndex);
+  const id = input.slice(separatorIndex + 1);
+  if (!OmTopologyNodeKindSchema.safeParse(kind).success) {
+    throw new Error(`Topology node ref "${input}" has unsupported kind "${kind}"`);
+  }
+  return OmTopologyNodeRefSchema.parse({ kind, id });
+}
+function defineTopologyRelationship(input) {
+  return OmTopologyRelationshipSchema.parse({
+    ...input,
+    from: compileTopologyNodeRef(input.from),
+    to: compileTopologyNodeRef(input.to)
+  });
+}
+function defineTopology(relationships) {
+  const entries = Array.isArray(relationships) ? relationships.map((relationship, index) => [`relationship-${index + 1}`, relationship]) : Object.entries(relationships);
+  return OmTopologyDomainSchema.parse({
+    version: 1,
+    relationships: Object.fromEntries(entries.map(([key, relationship]) => [key, defineTopologyRelationship(relationship)]))
+  });
+}
 var PolicyIdSchema = ModelIdSchema;
 var PolicyApplicabilitySchema = z.object({
   systemIds: z.array(ModelIdSchema.meta({ ref: "system" })).default([]),
@@ -1878,6 +2075,7 @@ z.enum([
   "systems",
   "ontology",
   "resources",
+  "topology",
   "actions",
   "entities",
   "policies",
@@ -1897,6 +2095,7 @@ var DEFAULT_ORGANIZATION_MODEL_DOMAIN_METADATA = {
   systems: { version: 1, lastModified: "2026-05-10" },
   ontology: { version: 1, lastModified: "2026-05-14" },
   resources: { version: 1, lastModified: "2026-05-10" },
+  topology: { version: 1, lastModified: "2026-05-14" },
   actions: { version: 1, lastModified: "2026-05-10" },
   entities: { version: 1, lastModified: "2026-05-10" },
   policies: { version: 1, lastModified: "2026-05-10" },
@@ -1912,6 +2111,7 @@ var OrganizationModelDomainMetadataByDomainSchema = z.object({
   systems: OrganizationModelDomainMetadataSchema,
   ontology: OrganizationModelDomainMetadataSchema,
   resources: OrganizationModelDomainMetadataSchema,
+  topology: OrganizationModelDomainMetadataSchema,
   actions: OrganizationModelDomainMetadataSchema,
   entities: OrganizationModelDomainMetadataSchema,
   policies: OrganizationModelDomainMetadataSchema,
@@ -1930,6 +2130,7 @@ var OrganizationModelSchemaBase = z.object({
   systems: SystemsDomainSchema.default(DEFAULT_ORGANIZATION_MODEL_SYSTEMS),
   ontology: OntologyScopeSchema.default(DEFAULT_ONTOLOGY_SCOPE),
   resources: ResourcesDomainSchema.default(DEFAULT_ORGANIZATION_MODEL_RESOURCES),
+  topology: OmTopologyDomainSchema.default(DEFAULT_ORGANIZATION_MODEL_TOPOLOGY),
   actions: ActionsDomainSchema.default(DEFAULT_ORGANIZATION_MODEL_ACTIONS),
   entities: EntitiesDomainSchema.default(DEFAULT_ORGANIZATION_MODEL_ENTITIES),
   policies: PoliciesDomainSchema.default(DEFAULT_ORGANIZATION_MODEL_POLICIES),
@@ -2272,6 +2473,25 @@ OrganizationModelSchemaBase.superRefine((model, ctx) => {
     surface: ontologyCompilation.ontology.surfaces
   };
   const ontologyIds = new Set(Object.values(ontologyIndexByKind).flatMap((index) => Object.keys(index)));
+  function topologyTargetExists(ref) {
+    if (ref.kind === "system") return systemsById.has(ref.id);
+    if (ref.kind === "resource") return resourcesById.has(ref.id);
+    if (ref.kind === "ontology") return ontologyIds.has(ref.id);
+    if (ref.kind === "policy") return policiesById.has(ref.id);
+    if (ref.kind === "role") return rolesById.has(ref.id);
+    return true;
+  }
+  Object.entries(model.topology.relationships).forEach(([relationshipId, relationship]) => {
+    ["from", "to"].forEach((side) => {
+      const ref = relationship[side];
+      if (topologyTargetExists(ref)) return;
+      addIssue(
+        ctx,
+        ["topology", "relationships", relationshipId, side],
+        `Topology relationship "${relationshipId}" ${side} references unknown ${ref.kind} "${ref.id}"`
+      );
+    });
+  });
   const ontologyReferenceKeyKinds = {
     valueType: "value-type",
     catalogType: "catalog",
@@ -2410,11 +2630,18 @@ OrganizationModelSchemaBase.superRefine((model, ctx) => {
     }
   });
   function validateResourceOntologyBinding(resourceId, bindingKey, expectedKind, ids) {
-    ids?.forEach((ontologyId, ontologyIndex) => {
+    const ontologyIds2 = ids === void 0 ? [] : Array.isArray(ids) ? ids : [ids];
+    ontologyIds2.forEach((ontologyId, ontologyIndex) => {
       if (ontologyIndexByKind[expectedKind][ontologyId] === void 0) {
         addIssue(
           ctx,
-          ["resources", resourceId, "ontology", bindingKey, ontologyIndex],
+          [
+            "resources",
+            resourceId,
+            "ontology",
+            bindingKey,
+            ...Array.isArray(ids) ? [ontologyIndex] : []
+          ],
           `Resource "${resourceId}" ontology binding "${bindingKey}" references unknown ${expectedKind} ontology ID "${ontologyId}"`
         );
       }
@@ -2423,7 +2650,8 @@ OrganizationModelSchemaBase.superRefine((model, ctx) => {
   Object.values(model.resources).forEach((resource) => {
     const binding = resource.ontology;
     if (binding === void 0) return;
-    validateResourceOntologyBinding(resource.id, "implements", "action", binding.implements);
+    validateResourceOntologyBinding(resource.id, "actions", "action", binding.actions);
+    validateResourceOntologyBinding(resource.id, "primaryAction", "action", binding.primaryAction);
     validateResourceOntologyBinding(resource.id, "reads", "object", binding.reads);
     validateResourceOntologyBinding(resource.id, "writes", "object", binding.writes);
     validateResourceOntologyBinding(resource.id, "usesCatalogs", "catalog", binding.usesCatalogs);
@@ -2870,6 +3098,119 @@ function getRuntimeResources(resources) {
     }))
   ];
 }
+function hasOntologySources(organizationModel) {
+  return organizationModel.ontology !== void 0 || organizationModel.entities !== void 0 || organizationModel.actions !== void 0 || Object.values(organizationModel.systems ?? {}).some(systemHasOntologySource);
+}
+function systemHasOntologySource(system) {
+  if (system.ontology !== void 0 || system.content !== void 0 && Object.keys(system.content).length > 0) return true;
+  return Object.values(system.systems ?? system.subsystems ?? {}).some(systemHasOntologySource);
+}
+function ontologyIndexForKind(index, kind) {
+  switch (kind) {
+    case "object":
+      return index.objectTypes;
+    case "link":
+      return index.linkTypes;
+    case "action":
+      return index.actionTypes;
+    case "catalog":
+      return index.catalogTypes;
+    case "event":
+      return index.eventTypes;
+    case "interface":
+      return index.interfaceTypes;
+    case "value-type":
+      return index.valueTypes;
+    case "property":
+      return index.sharedProperties;
+    case "group":
+      return index.groups;
+    case "surface":
+      return index.surfaces;
+  }
+}
+function sameJson(left, right) {
+  return JSON.stringify(left ?? null) === JSON.stringify(right ?? null);
+}
+function addOntologyBindingIssues(issues, orgName, resource, ontologyIndex) {
+  const binding = resource.ontology;
+  if (binding === void 0) return;
+  if ((resource.kind === "workflow" || resource.kind === "agent") && (binding.actions?.length ?? 0) === 0) {
+    addGovernanceIssue(
+      issues,
+      "missing-ontology-actions",
+      orgName,
+      resource.id,
+      `[${orgName}] Resource '${resource.id}' declares ontology bindings but no ontology actions.`
+    );
+  }
+  if (binding.primaryAction !== void 0 && !binding.actions?.includes(binding.primaryAction)) {
+    addGovernanceIssue(
+      issues,
+      "primary-action-mismatch",
+      orgName,
+      resource.id,
+      `[${orgName}] Resource '${resource.id}' primaryAction '${binding.primaryAction}' must be included in ontology.actions.`
+    );
+  }
+  if (ontologyIndex === void 0) return;
+  const validateRefs = (bindingKey, expectedKind, refs) => {
+    const values = refs === void 0 ? [] : Array.isArray(refs) ? refs : [refs];
+    const index = ontologyIndexForKind(ontologyIndex, expectedKind);
+    for (const ref of values) {
+      if (index[ref] !== void 0) continue;
+      addGovernanceIssue(
+        issues,
+        "ontology-reference-missing",
+        orgName,
+        resource.id,
+        `[${orgName}] Resource '${resource.id}' ontology.${bindingKey} references missing ${expectedKind} ontology record '${ref}'.`
+      );
+    }
+  };
+  validateRefs("actions", "action", binding.actions);
+  validateRefs("primaryAction", "action", binding.primaryAction);
+  validateRefs("reads", "object", binding.reads);
+  validateRefs("writes", "object", binding.writes);
+  validateRefs("usesCatalogs", "catalog", binding.usesCatalogs);
+  validateRefs("emits", "event", binding.emits);
+}
+function addTopologyIssues(issues, orgName, deployment, organizationModel, systemsById, omResourcesById, ontologyIndex) {
+  const relationships = organizationModel.topology?.relationships;
+  if (relationships === void 0) return;
+  const rolesById = new Set(Object.keys(organizationModel.roles ?? {}));
+  const policiesById = new Set(Object.keys(organizationModel.policies ?? {}));
+  const triggerIds = new Set(deployment.triggers?.map((trigger) => trigger.resourceId) ?? []);
+  const humanCheckpointIds = new Set(deployment.humanCheckpoints?.map((checkpoint) => checkpoint.resourceId) ?? []);
+  const externalResourceIds = new Set(deployment.externalResources?.map((external) => external.resourceId) ?? []);
+  const topologyRefExists = (ref) => {
+    if (ref.kind === "system") return systemsById.has(ref.id);
+    if (ref.kind === "resource") return omResourcesById.has(ref.id);
+    if (ref.kind === "policy") return policiesById.has(ref.id);
+    if (ref.kind === "role") return rolesById.has(ref.id);
+    if (ref.kind === "trigger") return triggerIds.has(ref.id);
+    if (ref.kind === "humanCheckpoint") return humanCheckpointIds.has(ref.id);
+    if (ref.kind === "externalResource") return externalResourceIds.has(ref.id);
+    if (ref.kind === "ontology") {
+      if (ontologyIndex === void 0) return true;
+      return Object.values(ontologyIndex).some((records) => records[ref.id] !== void 0);
+    }
+    return false;
+  };
+  for (const [relationshipId, relationship] of Object.entries(relationships)) {
+    ["from", "to"].forEach((side) => {
+      const ref = relationship[side];
+      if (topologyRefExists(ref)) return;
+      addGovernanceIssue(
+        issues,
+        "topology-reference-missing",
+        orgName,
+        ref.id,
+        `[${orgName}] Topology relationship '${relationshipId}' ${side} references missing ${ref.kind} '${ref.id}'.`
+      );
+    });
+  }
+}
 function validateResourceGovernance(orgName, deployment, organizationModel = deployment.organizationModel, options = {}) {
   const mode = getResourceValidatorMode(options.mode);
   const omResourcesMap = organizationModel?.resources;
@@ -2885,6 +3226,17 @@ function validateResourceGovernance(orgName, deployment, organizationModel = dep
   const omResourcesById = new Map(activeOmResources.map((resource) => [resource.id, resource]));
   const runtimeResources = getRuntimeResources(deployment);
   const runtimeResourcesById = new Map(runtimeResources.map((resource) => [resource.resourceId, resource]));
+  const ontologyCompilation = hasOntologySources(organizationModel) ? compileOrganizationOntology(organizationModel) : void 0;
+  const ontologyIndex = ontologyCompilation?.ontology;
+  for (const diagnostic of ontologyCompilation?.diagnostics ?? []) {
+    addGovernanceIssue(
+      issues,
+      "ontology-reference-missing",
+      orgName,
+      diagnostic.id,
+      `[${orgName}] ${diagnostic.message}`
+    );
+  }
   for (const resource of activeOmResources) {
     if (!systemsById.has(resource.systemPath)) {
       addGovernanceIssue(
@@ -2924,6 +3276,16 @@ function validateResourceGovernance(orgName, deployment, organizationModel = dep
         `[${orgName}] Resource '${resource.id}' system mismatch: code descriptor has '${runtimeResource.descriptor.systemPath}', OM has '${resource.systemPath}'.`
       );
     }
+    if (runtimeResource.descriptor && !sameJson(runtimeResource.descriptor.ontology, resource.ontology)) {
+      addGovernanceIssue(
+        issues,
+        "descriptor-mismatch",
+        orgName,
+        resource.id,
+        `[${orgName}] Resource '${resource.id}' ontology descriptor mismatch between code and OM.`
+      );
+    }
+    addOntologyBindingIssues(issues, orgName, resource, ontologyIndex);
   }
   for (const runtimeResource of runtimeResources) {
     const omResource = omResourcesById.get(runtimeResource.resourceId);
@@ -2965,6 +3327,7 @@ function validateResourceGovernance(orgName, deployment, organizationModel = dep
       );
     }
   }
+  addTopologyIssues(issues, orgName, deployment, organizationModel, systemsById, omResourcesById, ontologyIndex);
   emitGovernanceIssues(issues, mode, options.onWarning);
   return {
     valid: issues.length === 0,
@@ -6345,6 +6708,17 @@ var ResourceRegistry = class {
     return cache.commandView;
   }
 };
+
+// ../core/src/platform/registry/types.ts
+function bindResourceDescriptor(definition) {
+  const { resource, ...rest } = definition;
+  return {
+    ...rest,
+    resource,
+    resourceId: resource.id,
+    type: resource.kind
+  };
+}
 DisplayMetadataSchema.extend({
   id: ModelIdSchema,
   order: z.number().min(0)
@@ -6917,7 +7291,7 @@ var DEFAULT_ORGANIZATION_MODEL_NAVIGATION = {
       business: {
         type: "group",
         label: "Business",
-        icon: "business",
+        icon: "briefcase",
         order: 20,
         children: {
           sales: {
@@ -6934,7 +7308,7 @@ var DEFAULT_ORGANIZATION_MODEL_NAVIGATION = {
             label: "Clients",
             path: "/clients",
             surfaceType: "list",
-            icon: "projects",
+            icon: "clients",
             order: 20,
             targets: { systems: ["clients"] }
           },
@@ -7308,7 +7682,7 @@ var DEFAULT_ORGANIZATION_MODEL = {
       enabled: true,
       lifecycle: "active",
       color: "orange",
-      icon: "projects",
+      icon: "clients",
       path: "/clients"
     },
     operations: {
@@ -7612,6 +7986,7 @@ var DEFAULT_ORGANIZATION_MODEL = {
   },
   ontology: DEFAULT_ONTOLOGY_SCOPE,
   resources: DEFAULT_ORGANIZATION_MODEL_RESOURCES,
+  topology: DEFAULT_ORGANIZATION_MODEL_TOPOLOGY,
   actions: DEFAULT_ORGANIZATION_MODEL_ACTIONS,
   entities: DEFAULT_ORGANIZATION_MODEL_ENTITIES2,
   policies: DEFAULT_ORGANIZATION_MODEL_POLICIES,
@@ -8864,4 +9239,4 @@ function isOurReplyAction(deal) {
 var listBuilderStageKeys = Object.keys(LEAD_GEN_STAGE_CATALOG);
 var ListBuilderStageKeySchema = z.enum(listBuilderStageKeys);
 
-export { ActivityEventSchema, BuildPlanSnapshotStepSchema, ProspectingBuildTemplateSchema as BuildTemplateSchema, CRM_PIPELINE_DEFINITION, CrmStageKeySchema, CrmStateKeySchema, DEFAULT_CRM_ACTIONS, EmailSchema, ExecutionError, LEAD_GEN_STAGE_CATALOG, ListBuilderStageKeySchema, ProcessingStageStatusSchema, RegistryValidationError, ResourceRegistry, StepType, ToolingError, deriveActions, validateResourceGovernance };
+export { ActivityEventSchema, BuildPlanSnapshotStepSchema, ProspectingBuildTemplateSchema as BuildTemplateSchema, CRM_PIPELINE_DEFINITION, CrmStageKeySchema, CrmStateKeySchema, DEFAULT_CRM_ACTIONS, EmailSchema, ExecutionError, LEAD_GEN_STAGE_CATALOG, ListBuilderStageKeySchema, ProcessingStageStatusSchema, RegistryValidationError, ResourceRegistry, StepType, ToolingError, bindResourceDescriptor, defineResource, defineResourceOntology, defineResources, defineTopology, defineTopologyRelationship, deriveActions, parseTopologyNodeRef, topologyRef, topologyRelationship, validateResourceGovernance };