@elevasis/sdk 1.44.0 → 1.44.2

package/dist/cli.cjs

@@ -44117,17 +44117,17 @@ function getLeadGenCrmHandoffResourceIds(model) {
     (resource) => resource.systemPath === LEAD_GEN_CRM_HANDOFF_INTERFACE.systemPath && resource.ontology?.usesCatalogs?.includes(CRM_PIPELINE_CATALOG_ONTOLOGY_ID) === true
   ).map((resource) => resource.id);
 }
-function getSystemInterfaceReadinessMarker(model, request) {
-  const system = getSystem(model, request.systemPath);
+function getSystemInterfaceReadinessMarker(model, request2) {
+  const system = getSystem(model, request2.systemPath);
   if (system === void 0) return void 0;
-  if (request.systemPath === LEAD_GEN_CRM_HANDOFF_INTERFACE.systemPath && request.interfaceKey === LEAD_GEN_CRM_HANDOFF_INTERFACE.interfaceKey) {
+  if (request2.systemPath === LEAD_GEN_CRM_HANDOFF_INTERFACE.systemPath && request2.interfaceKey === LEAD_GEN_CRM_HANDOFF_INTERFACE.interfaceKey) {
     return {
       lifecycle: "active",
       readinessProfile: LEAD_GEN_CRM_HANDOFF_INTERFACE.readinessProfile,
       resourceIds: getLeadGenCrmHandoffResourceIds(model)
     };
   }
-  if (request.interfaceKey === "api" && system.apiInterface !== void 0) {
+  if (request2.interfaceKey === "api" && system.apiInterface !== void 0) {
     return system.apiInterface;
   }
   return void 0;
@@ -44186,24 +44186,24 @@ function requireContractReadiness(issues, index, resources, contract, context) {
     requireScopedBinding(issues, catalogs, "usesCatalogs", catalogId, context);
   }
 }
-function computeInterfaceReadiness(model, request) {
+function computeInterfaceReadiness(model, request2) {
   const issues = [];
-  const system = getSystem(model, request.systemPath);
-  const systemInterface = getSystemInterfaceReadinessMarker(model, request);
-  const readinessProfile = systemInterface === void 0 ? void 0 : profileForInterface(request.systemPath, request.interfaceKey, systemInterface.readinessProfile);
+  const system = getSystem(model, request2.systemPath);
+  const systemInterface = getSystemInterfaceReadinessMarker(model, request2);
+  const readinessProfile = systemInterface === void 0 ? void 0 : profileForInterface(request2.systemPath, request2.interfaceKey, systemInterface.readinessProfile);
   const scopedResourceIds = systemInterface?.resourceIds ?? [];
   if (system === void 0) {
     addReadinessIssue(
       issues,
       "SYSTEM_INTERFACE_MISSING",
       "missing-system",
-      `System "${request.systemPath}" is missing.`,
-      { ref: request.systemPath }
+      `System "${request2.systemPath}" is missing.`,
+      { ref: request2.systemPath }
     );
     return {
       ready: false,
-      systemPath: request.systemPath,
-      interfaceKey: request.interfaceKey,
+      systemPath: request2.systemPath,
+      interfaceKey: request2.interfaceKey,
       scopedResourceIds,
       issues
     };
@@ -44213,13 +44213,13 @@ function computeInterfaceReadiness(model, request) {
       issues,
       "SYSTEM_INTERFACE_MISSING",
       "missing-interface",
-      `System "${request.systemPath}" does not declare interface "${request.interfaceKey}".`,
-      { path: readinessMarkerPath(request) }
+      `System "${request2.systemPath}" does not declare interface "${request2.interfaceKey}".`,
+      { path: readinessMarkerPath(request2) }
     );
     return {
       ready: false,
-      systemPath: request.systemPath,
-      interfaceKey: request.interfaceKey,
+      systemPath: request2.systemPath,
+      interfaceKey: request2.interfaceKey,
       scopedResourceIds,
       issues
     };
@@ -44229,11 +44229,11 @@ function computeInterfaceReadiness(model, request) {
       issues,
       "SYSTEM_INTERFACE_DISABLED",
       "inactive-interface",
-      `System Interface "${formatInterfaceIdentity(request.systemPath, request.interfaceKey)}" lifecycle is "${systemInterface.lifecycle}".`,
-      { path: `${readinessMarkerPath(request)}.lifecycle` }
+      `System Interface "${formatInterfaceIdentity(request2.systemPath, request2.interfaceKey)}" lifecycle is "${systemInterface.lifecycle}".`,
+      { path: `${readinessMarkerPath(request2)}.lifecycle` }
     );
   }
-  const checkedReadinessProfile = readinessProfile ?? profileForInterface(request.systemPath, request.interfaceKey);
+  const checkedReadinessProfile = readinessProfile ?? profileForInterface(request2.systemPath, request2.interfaceKey);
   const isBuiltIn = isBuiltInReadinessProfile(checkedReadinessProfile);
   const readinessContract = systemInterface.readinessContract;
   if (!isBuiltIn && readinessContract === void 0) {
@@ -44241,13 +44241,13 @@ function computeInterfaceReadiness(model, request) {
       issues,
       "SYSTEM_INTERFACE_INVALID",
       "missing-readiness-contract",
-      `System Interface "${formatInterfaceIdentity(request.systemPath, request.interfaceKey)}" uses custom readiness profile "${checkedReadinessProfile}" but declares no readinessContract. Built-in profiles: ${formatSupportedReadinessProfiles()}.`,
-      { path: `${readinessMarkerPath(request)}.readinessContract`, ref: checkedReadinessProfile }
+      `System Interface "${formatInterfaceIdentity(request2.systemPath, request2.interfaceKey)}" uses custom readiness profile "${checkedReadinessProfile}" but declares no readinessContract. Built-in profiles: ${formatSupportedReadinessProfiles()}.`,
+      { path: `${readinessMarkerPath(request2)}.readinessContract`, ref: checkedReadinessProfile }
     );
     return {
       ready: false,
-      systemPath: request.systemPath,
-      interfaceKey: request.interfaceKey,
+      systemPath: request2.systemPath,
+      interfaceKey: request2.interfaceKey,
       readinessProfile: checkedReadinessProfile,
       scopedResourceIds,
       issues
@@ -44258,29 +44258,29 @@ function computeInterfaceReadiness(model, request) {
       issues,
       "SYSTEM_INTERFACE_NOT_READY",
       "missing-scoped-resources",
-      `System Interface "${formatInterfaceIdentity(request.systemPath, request.interfaceKey)}" must scope at least one active resource.`,
-      { path: `${readinessMarkerPath(request)}.resourceIds` }
+      `System Interface "${formatInterfaceIdentity(request2.systemPath, request2.interfaceKey)}" must scope at least one active resource.`,
+      { path: `${readinessMarkerPath(request2)}.resourceIds` }
     );
   }
-  const resources = getActiveScopedResources(model, scopedResourceIds, issues, request);
+  const resources = getActiveScopedResources(model, scopedResourceIds, issues, request2);
   const index = tryCompileBusinessOntology(model, checkedReadinessProfile, issues);
   if (index !== void 0) {
     if (checkedReadinessProfile === LEAD_GEN_API_INTERFACE.readinessProfile) {
-      requireLeadGenInterfaceReadiness(issues, index, resources, request);
+      requireLeadGenInterfaceReadiness(issues, index, resources, request2);
     } else if (checkedReadinessProfile === CRM_API_INTERFACE.readinessProfile) {
-      requireCrmInterfaceReadiness(issues, index, resources, request);
+      requireCrmInterfaceReadiness(issues, index, resources, request2);
     } else if (checkedReadinessProfile === LEAD_GEN_CRM_HANDOFF_INTERFACE.readinessProfile) {
-      requireLeadGenInterfaceReadiness(issues, index, resources, request);
-      requireCrmInterfaceReadiness(issues, index, resources, { ...request, allowForeignOwner: true });
-      requireHandoffBridgeReadiness(issues, model, request);
+      requireLeadGenInterfaceReadiness(issues, index, resources, request2);
+      requireCrmInterfaceReadiness(issues, index, resources, { ...request2, allowForeignOwner: true });
+      requireHandoffBridgeReadiness(issues, model, request2);
     } else if (readinessContract !== void 0) {
-      requireContractReadiness(issues, index, resources, readinessContract, request);
+      requireContractReadiness(issues, index, resources, readinessContract, request2);
     }
   }
   return {
     ready: issues.length === 0,
-    systemPath: request.systemPath,
-    interfaceKey: request.interfaceKey,
+    systemPath: request2.systemPath,
+    interfaceKey: request2.interfaceKey,
     readinessProfile: checkedReadinessProfile,
     scopedResourceIds,
     issues
@@ -46160,22 +46160,72 @@ function getApiKey(apiUrl) {
   const key = resolveApiKey(isProd);
   if (!key) {
     const varName = isProd ? "ELEVASIS_PLATFORM_KEY" : "ELEVASIS_PLATFORM_KEY_DEV";
-    throw new Error(
-      `${varName} environment variable is required.
-Set it in your .env file: ${varName}=sk_...`
-    );
+    throw new Error(`${varName} environment variable is required.
+Set it in your .env file: ${varName}=sk_...`);
   }
   return key;
 }
-async function apiGet(endpoint, apiUrl = resolveApiUrl()) {
-  const response = await fetch(`${apiUrl}${endpoint}`, {
-    headers: { Authorization: `Bearer ${getApiKey(apiUrl)}` }
-  });
+var DEFAULT_TIMEOUT_MS = 2 * 60 * 60 * 1e3;
+function resolveTimeoutMs() {
+  const raw = process.env.ELEVASIS_CLI_TIMEOUT_MS;
+  if (!raw) return DEFAULT_TIMEOUT_MS;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;
+}
+function formatElapsed(ms) {
+  return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
+}
+var GATEWAY_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
+function describeGatewayFailure(status, endpoint, elapsedMs) {
+  return `API request failed (${status}) after ${formatElapsed(elapsedMs)}: a gateway between this CLI and the API ended the connection.
+This is NOT the API rejecting the request, and the work may still be running server-side -- a status code from a proxy says nothing about whether the handler completed.
+  Endpoint: ${endpoint}
+  Check for a result before re-running, or the same work may execute twice:
+    executions -> 'elevasis execution <workflow> <id>'
+    session turns -> 'elevasis-sdk session:messages <session-id> --all'
+  Workflow executions can avoid this entirely with 'exec --async', which returns immediately
+  and polls. Session turns have no async variant, so a long turn is exposed to this cutoff.`;
+}
+async function request(method, endpoint, apiUrl, body) {
+  const timeoutMs = resolveTimeoutMs();
+  const startedAt = Date.now();
+  const headers = { Authorization: `Bearer ${getApiKey(apiUrl)}` };
+  if (body !== void 0) headers["Content-Type"] = "application/json";
+  let response;
+  try {
+    response = await fetch(`${apiUrl}${endpoint}`, {
+      method,
+      headers,
+      ...body !== void 0 && { body: JSON.stringify(body) },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error46) {
+    const elapsedMs = Date.now() - startedAt;
+    if (error46 instanceof Error && error46.name === "TimeoutError") {
+      throw new Error(
+        `Request timed out after ${formatElapsed(elapsedMs)} (limit ${formatElapsed(timeoutMs)}).
+  Endpoint: ${endpoint}
+  The server may still be working -- check for a result before re-running.
+  Raise the limit with ELEVASIS_CLI_TIMEOUT_MS, or, for a workflow execution, submit it
+  with 'exec --async'. Session turns have no async variant.`
+      );
+    }
+    const detail = error46 instanceof Error ? error46.message : String(error46);
+    throw new Error(
+      `Could not reach the API after ${formatElapsed(elapsedMs)}: ${detail}
+  Endpoint: ${apiUrl}${endpoint}
+  No HTTP status was returned, so the request may never have been received.`
+    );
+  }
   if (!response.ok) {
+    const elapsedMs = Date.now() - startedAt;
     const errorText = await response.text();
     if (response.status === 401) {
       throw new Error(`401 Unauthorized: Invalid or missing ELEVASIS_PLATFORM_KEY. Check your .env file.`);
     }
+    if (GATEWAY_STATUSES.has(response.status)) {
+      throw new Error(describeGatewayFailure(response.status, endpoint, elapsedMs));
+    }
     throw new Error(`API request failed (${response.status}): ${errorText}`);
   }
   if (response.status === 204) {
@@ -46183,55 +46233,17 @@ async function apiGet(endpoint, apiUrl = resolveApiUrl()) {
   }
   return response.json();
 }
+async function apiGet(endpoint, apiUrl = resolveApiUrl()) {
+  return request("GET", endpoint, apiUrl);
+}
 async function apiPost(endpoint, body, apiUrl = resolveApiUrl()) {
-  const response = await fetch(`${apiUrl}${endpoint}`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${getApiKey(apiUrl)}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`API request failed (${response.status}): ${errorText}`);
-  }
-  if (response.status === 204) {
-    return {};
-  }
-  return response.json();
+  return request("POST", endpoint, apiUrl, body);
 }
 async function apiPatch(endpoint, body, apiUrl = resolveApiUrl()) {
-  const response = await fetch(`${apiUrl}${endpoint}`, {
-    method: "PATCH",
-    headers: {
-      Authorization: `Bearer ${getApiKey(apiUrl)}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(body)
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`API request failed (${response.status}): ${errorText}`);
-  }
-  if (response.status === 204) {
-    return {};
-  }
-  return response.json();
+  return request("PATCH", endpoint, apiUrl, body);
 }
 async function apiDelete(endpoint, apiUrl = resolveApiUrl()) {
-  const response = await fetch(`${apiUrl}${endpoint}`, {
-    method: "DELETE",
-    headers: { Authorization: `Bearer ${getApiKey(apiUrl)}` }
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`API request failed (${response.status}): ${errorText}`);
-  }
-  if (response.status === 204) {
-    return {};
-  }
-  return response.json();
+  return request("DELETE", endpoint, apiUrl);
 }
 
 // src/cli/wrap-action.ts
@@ -46253,7 +46265,7 @@ function wrapAction(commandName, fn) {
 // package.json
 var package_default = {
   name: "@elevasis/sdk",
-  version: "1.44.0",
+  version: "1.44.2",
   description: "SDK for building Elevasis organization resources",
   type: "module",
   bin: {

package/dist/test-utils/index.js

@@ -5295,6 +5295,10 @@ var MEMORY_DOMAINS = {
    *
    * Tools manage complex structured data (caches, indexes, etc.)
    * that would be error-prone for LLM to update via JSON strings.
+   *
+   * No tool currently writes these three keys, so in practice the guard reserves the names
+   * against the LLM rather than arbitrating a live conflict. That is still enforcement --
+   * see `validateMemoryKeyOwnership` in `./utils` -- not dead code.
    */
   TOOL_OWNED: [
     "notion-pages-cache",
@@ -5303,20 +5307,10 @@ var MEMORY_DOMAINS = {
     // GitHub tools manage repository structure
     "slack-channel-cache"
     // Slack tools manage channel data
-  ],
-  /**
-   * Action-owned keys
-   * Updated by framework actions
-   * LLM cannot modify these via memoryOps
-   *
-   * Actions manage framework state that controls execution flow. Empty today -- the one
-   * action that ever wrote here was retired. Kept as its own domain because a future
-   * action-managed key belongs here, not folded into TOOL_OWNED.
-   */
-  ACTION_OWNED: []
+  ]
   /**
    * LLM-owned keys
-   * All keys NOT in TOOL_OWNED or ACTION_OWNED
+   * All keys NOT in TOOL_OWNED
    * Managed via memoryOps by agent reasoning
    *
    * LLM manages semantic memory (business context, decisions, etc.)
@@ -5326,12 +5320,8 @@ var MEMORY_DOMAINS = {
 function isToolOwnedKey(key) {
   return MEMORY_DOMAINS.TOOL_OWNED.includes(key);
 }
-function isActionOwnedKey(key) {
-  return MEMORY_DOMAINS.ACTION_OWNED.includes(key);
-}
 function getKeyOwner(key) {
   if (isToolOwnedKey(key)) return "tool";
-  if (isActionOwnedKey(key)) return "action";
   return "llm";
 }
 
@@ -5358,7 +5348,7 @@ function addToolError(memoryManager, action, errorMessage, iteration, turnNumber
   });
 }
 function validateMemoryKeyOwnership(key, logger, iteration) {
-  if (isToolOwnedKey(key) || isActionOwnedKey(key)) {
+  if (isToolOwnedKey(key)) {
     const owner = getKeyOwner(key);
     logger.action(
       "memory-set-rejected",
@@ -5442,10 +5432,15 @@ var DEFAULT_EXECUTION_TIMEOUT = 72e5;
 
 // ../core/src/execution/engine/agent/memory/truncation.ts
 var CLOSING_BRACKET_RESERVE = 32;
-function stripDanglingTail(text) {
+var DANGLING_KEY_WITH_COLON = /,?\s*"(?:[^"\\]|\\.)*"\s*:\s*$/;
+var DANGLING_KEY_NO_COLON = /([{,])\s*"(?:[^"\\]|\\.)*"\s*$/;
+function stripDanglingTail(text, innermostIsObject) {
   let out = text.replace(/,\s*$/, "");
-  const danglingKey = /,?\s*"(?:[^"\\]|\\.)*"\s*:\s*$/;
-  if (danglingKey.test(out)) out = out.replace(danglingKey, "").replace(/,\s*$/, "");
+  if (DANGLING_KEY_WITH_COLON.test(out)) {
+    out = out.replace(DANGLING_KEY_WITH_COLON, "").replace(/,\s*$/, "");
+  } else if (innermostIsObject && DANGLING_KEY_NO_COLON.test(out)) {
+    out = out.replace(DANGLING_KEY_NO_COLON, "$1").replace(/,\s*$/, "");
+  }
   return out;
 }
 function safeStructuralPrefix(raw, cutAt) {
@@ -5472,7 +5467,7 @@ function safeStructuralPrefix(raw, cutAt) {
     }
   }
   const cutPoint = inString ? openStringStart : limit;
-  const base = stripDanglingTail(raw.slice(0, cutPoint));
+  const base = stripDanglingTail(raw.slice(0, cutPoint), stack[stack.length - 1] === "}");
   return base + [...stack].reverse().join("");
 }
 function truncateContent(content, maxTokens) {

package/dist/worker/index.js

@@ -3387,6 +3387,10 @@ var MEMORY_DOMAINS = {
    *
    * Tools manage complex structured data (caches, indexes, etc.)
    * that would be error-prone for LLM to update via JSON strings.
+   *
+   * No tool currently writes these three keys, so in practice the guard reserves the names
+   * against the LLM rather than arbitrating a live conflict. That is still enforcement --
+   * see `validateMemoryKeyOwnership` in `./utils` -- not dead code.
    */
   TOOL_OWNED: [
     "notion-pages-cache",
@@ -3395,20 +3399,10 @@ var MEMORY_DOMAINS = {
     // GitHub tools manage repository structure
     "slack-channel-cache"
     // Slack tools manage channel data
-  ],
-  /**
-   * Action-owned keys
-   * Updated by framework actions
-   * LLM cannot modify these via memoryOps
-   *
-   * Actions manage framework state that controls execution flow. Empty today -- the one
-   * action that ever wrote here was retired. Kept as its own domain because a future
-   * action-managed key belongs here, not folded into TOOL_OWNED.
-   */
-  ACTION_OWNED: []
+  ]
   /**
    * LLM-owned keys
-   * All keys NOT in TOOL_OWNED or ACTION_OWNED
+   * All keys NOT in TOOL_OWNED
    * Managed via memoryOps by agent reasoning
    *
    * LLM manages semantic memory (business context, decisions, etc.)
@@ -3418,12 +3412,8 @@ var MEMORY_DOMAINS = {
 function isToolOwnedKey(key) {
   return MEMORY_DOMAINS.TOOL_OWNED.includes(key);
 }
-function isActionOwnedKey(key) {
-  return MEMORY_DOMAINS.ACTION_OWNED.includes(key);
-}
 function getKeyOwner(key) {
   if (isToolOwnedKey(key)) return "tool";
-  if (isActionOwnedKey(key)) return "action";
   return "llm";
 }
 
@@ -3450,7 +3440,7 @@ function addToolError(memoryManager, action, errorMessage, iteration, turnNumber
   });
 }
 function validateMemoryKeyOwnership(key, logger, iteration) {
-  if (isToolOwnedKey(key) || isActionOwnedKey(key)) {
+  if (isToolOwnedKey(key)) {
     const owner = getKeyOwner(key);
     logger.action(
       "memory-set-rejected",
@@ -3534,10 +3524,15 @@ var DEFAULT_EXECUTION_TIMEOUT = 72e5;
 
 // ../core/src/execution/engine/agent/memory/truncation.ts
 var CLOSING_BRACKET_RESERVE = 32;
-function stripDanglingTail(text) {
+var DANGLING_KEY_WITH_COLON = /,?\s*"(?:[^"\\]|\\.)*"\s*:\s*$/;
+var DANGLING_KEY_NO_COLON = /([{,])\s*"(?:[^"\\]|\\.)*"\s*$/;
+function stripDanglingTail(text, innermostIsObject) {
   let out = text.replace(/,\s*$/, "");
-  const danglingKey = /,?\s*"(?:[^"\\]|\\.)*"\s*:\s*$/;
-  if (danglingKey.test(out)) out = out.replace(danglingKey, "").replace(/,\s*$/, "");
+  if (DANGLING_KEY_WITH_COLON.test(out)) {
+    out = out.replace(DANGLING_KEY_WITH_COLON, "").replace(/,\s*$/, "");
+  } else if (innermostIsObject && DANGLING_KEY_NO_COLON.test(out)) {
+    out = out.replace(DANGLING_KEY_NO_COLON, "$1").replace(/,\s*$/, "");
+  }
   return out;
 }
 function safeStructuralPrefix(raw, cutAt) {
@@ -3564,7 +3559,7 @@ function safeStructuralPrefix(raw, cutAt) {
     }
   }
   const cutPoint = inString ? openStringStart : limit;
-  const base = stripDanglingTail(raw.slice(0, cutPoint));
+  const base = stripDanglingTail(raw.slice(0, cutPoint), stack[stack.length - 1] === "}");
   return base + [...stack].reverse().join("");
 }
 function truncateContent(content, maxTokens) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elevasis/sdk",
-  "version": "1.44.0",
+  "version": "1.44.2",
   "description": "SDK for building Elevasis organization resources",
   "type": "module",
   "bin": {
@@ -58,9 +58,9 @@
     "tsup": "^8.0.0",
     "typescript": "5.9.2",
     "zod": "^4.1.0",
-    "@repo/core": "0.58.0",
-    "@repo/eslint-config": "0.0.0",
-    "@repo/typescript-config": "0.0.0"
+    "@repo/core": "0.59.0",
+    "@repo/typescript-config": "0.0.0",
+    "@repo/eslint-config": "0.0.0"
   },
   "scripts": {
     "lint": "eslint src --max-warnings 0",

package/reference/claude-config/sync-notes/2026-08-02-auth-guard-defaults-and-truncation-fix.md

@@ -0,0 +1,122 @@
+# Your auth guards now wait for organization context, and truncated tool results stay valid JSON
+
+## Why this note exists
+
+This train publishes all three packages at once — `@elevasis/core`, `@elevasis/ui`, and
+`@elevasis/sdk`. Four of the changes are things you can observe without changing a line of your own
+code, which is exactly why they are worth reading before you take the baseline bump.
+
+**1. `ProtectedRoute` now waits for organization context by default.** This is the one behavior
+change most likely to surprise you, because nothing in your project asked for it.
+
+Until now the default value of `waitForOrganization` depended on which import path a route file
+happened to use. Routes importing the guard from `@elevasis/ui/features/auth` defaulted to `false`
+and rendered before organization context existed; routes importing from `@elevasis/ui/auth`
+defaulted to `true` and waited. One application, two guard behaviors, decided by an import
+specifier. Both defaults are now `true`, resolved through a single shared predicate.
+
+We audited every template-family project before shipping this rather than assuming it was safe.
+Between 8 and 9 routes per project are affected — `index.tsx`, `knowledge.tsx`, and every
+`settings/*.tsx` — and **not one route in any project passes the prop explicitly**. Every affected
+route is organization-scoped, so none of them has a legitimate reason to render before organization
+context arrives. The measurable cost is that `settings/appearance.tsx` and `settings/account.tsx`
+are user-scoped and will now wait marginally longer than they strictly need to. That is latency, not
+breakage.
+
+If you have a route that genuinely must render before organization context exists, pass
+`waitForOrganization={false}` explicitly. Relying on the old default is no longer possible.
+
+**2. Invited members who have not signed up yet are now visibly distinguished.** A previous train
+made them _appear_ in your members list, which fixed wrong counts. It did not make them
+_identifiable_ — the type shipped but the renderer did not, so every member looked equally
+provisioned. `ProvisioningStateBadge` now ships inside `@elevasis/ui` and `OrgMembersList` renders it
+beside the existing status badge, in the same cell rather than a new column. A fully-provisioned
+member renders nothing, so nothing about your existing rows changes.
+
+**3. Membership responses carry an explicit `workosMembershipId`, and `membership.id` is the platform
+UUID.** The API used to be inconsistent about which identifier a membership response carried. It is
+now uniform: `id` is always the platform's own UUID, and the WorkOS identifier has its own named
+field. Both forms are accepted on lookup, so a request built either way still resolves.
+
+**`organization.workos_org_id` is unchanged and still carries the WorkOS `org_…` value verbatim.**
+That is the field your project selects organizations on and drives `switchToOrganization` with. It
+was audited specifically because this change was in the same area; nothing about it moved.
+
+**4. Four invitation API routes were removed** — `POST /api/invitations/accept`, and the
+`GET /api/invitations`, `GET /api/invitations/:id`, `GET /api/invitations/summary` trio. All four
+were dead surface with no caller in any project we could find. If you have an out-of-tree script
+calling one, it will now 404.
+
+**5. `@elevasis/sdk` fixes a JSON-safety defect in truncated tool results.** When a long tool result
+was truncated, a cut landing between a key's closing quote and its colon left behind a key with no
+value — `{"alpha":"…","nested"}` — which is not parseable JSON. Your agents read slightly malformed
+JSON rather than crashing, because the parser falls back to the raw string, so the practical impact
+was low. It is fixed regardless. The window was a few characters per key, which is why casual testing
+never surfaced it.
+
+## Applies to
+
+- **Every template-family project**, for items 1 through 3. All are consumed through the published
+  packages with no source edits on your side.
+- **Any project whose settings page renders `OrgMembersList`** — that is the published component,
+  so the badge arrives with the `@elevasis/ui` bump.
+- **Every project running agents**, for item 5. The truncation fix lives in the worker runtime that
+  `operations/` bundles, so it reaches you through `@elevasis/sdk`.
+- **Not applicable to your organization model, knowledge nodes, or workflow definitions.** Nothing in
+  this train touches authored content.
+
+## Required actions
+
+1. **Take the `@elevasis/core`, `@elevasis/ui`, and `@elevasis/sdk` baseline bumps** this train
+   propagates, then reinstall in `core/`, `ui/`, and `operations/`.
+
+2. **Clear the Vite cache and restart your dev server.** A stale `.vite` cache serves the old bundle
+   while every gate reports green — that is the specific way this failure hides:
+
+   ```bash
+   rm -rf ui/node_modules/.vite
+   pnpm -C ui dev
+   ```
+
+3. **Redeploy `operations/` to pick up the truncation fix.** The baseline bump changes what your
+   next bundle contains; it does not change what is already deployed:
+
+   ```bash
+   pnpm -C operations exec elevasis-sdk deploy
+   ```
+
+4. **Check any route that must render before organization context exists.** If you have one, add
+   `waitForOrganization={false}` explicitly. If you are unsure whether you have one, the audit result
+   above says you almost certainly do not — every affected route in every project is
+   organization-scoped already.
+
+## Verification
+
+- **Sign in and land on your home route.** This is the check that matters most, because the guard
+  default changed on the route that greets you. Confirm it renders, and that navigating to
+  `settings/appearance` and `settings/account` still works — those are the two user-scoped pages that
+  now wait for organization context they do not strictly need.
+- **Open your settings members page.** Any member you have invited who has not completed signup
+  should now carry a visible badge; fully-provisioned members should look exactly as before.
+- **Read the installed bundle, not the version number.** A bumped pin and a green sync report are
+  claims about intent; the installed file is the only ground truth:
+
+  ```bash
+  grep -rl "ProvisioningStateBadge" ui/node_modules/@elevasis/ui/dist/components/
+  grep -c "innermostIsObject" operations/node_modules/@elevasis/sdk/dist/worker/index.js
+  ```
+
+  No match on the first, or `0` on the second, means the install did not land regardless of what
+  `package.json` says.
+
+## Not handled by /git-sync
+
+- **The Vite cache clear and dev-server restart.** `/git-sync` propagates and commits the dependency
+  baseline. Your running dev server keeps serving the previously cached bundle until you do step 2
+  yourself, and it will look like the sync did nothing.
+- **The `operations/` redeploy.** Bumping the `@elevasis/sdk` pin changes what your next bundle
+  contains. Your currently deployed workers keep running the old bundle until you deploy.
+- **Adding `waitForOrganization={false}` to a route that needs it.** Nothing can detect that
+  automatically — only you know whether a route is legitimately pre-organization.
+- **Replacing calls to the four removed invitation routes.** If an out-of-tree script calls one, the
+  sync cannot see it.

package/reference/claude-config/sync-notes/2026-08-03-cli-gateway-errors-and-request-timeout.md

@@ -0,0 +1,120 @@
+# Your CLI now explains a 502 instead of just reporting one, and no request hangs forever
+
+## Why this note exists
+
+This train publishes one package — `@elevasis/sdk` — and every change in it is in the CLI you type
+commands into. Nothing about your workflows, organization model, or UI moves. But the CLI's failure
+messages change, and one of them changes in a way that is meant to stop you doing something harmful.
+
+**1. A gateway failure now tells you the work may still be running, and how to check.** Until now
+every non-2xx response produced the same shape: `API request failed (502)`. That message is
+technically accurate and practically dangerous, because the most natural reaction to it is to run the
+command again.
+
+A 502, 503, or 504 does not come from the platform API. It comes from a hop in front of it that ended
+your connection while the API was still working. The request you sent may have completed in full. We
+found this the hard way: a session turn returned 502 to the CLI after 300 seconds, and a later
+database query showed the turn had **completed successfully server-side in 319.8 seconds** with a
+model reply written and no error of any kind. The only thing that failed was the connection carrying
+the answer back. It was turn 14 of a 14-turn run — re-running blind would have executed that turn a
+second time.
+
+The new message says the proxy ended the connection, that this is not the API rejecting your request,
+that the work may still be running, and which command to use to look for a result before re-running.
+
+**2. Every CLI request is now bounded by a timeout, defaulting to 2 hours.** Before, the CLI used a
+bare `fetch()` with no signal, so a connection that stalled would sit there indefinitely with no
+output. The limit is deliberately set high — it matches the server's own socket budget on long routes.
+The goal is to bound an indefinite hang, not to police how long your work may take. Anything shorter
+would make the CLI give up on executions the API is still legitimately serving, turning a working long
+run into a reported failure. Override it with `ELEVASIS_CLI_TIMEOUT_MS` if you have a reason to.
+
+**3. "Timed out" and "never reached the API" are now different messages.** A bare `fetch()` rejection
+carries no status, so a dead port, a wrong API URL, and a stalled connection were indistinguishable.
+They now read differently.
+
+**4. The friendly authentication message now applies to every verb.** A 401 on `GET` printed a clear
+"check your platform key" message; a 401 on `POST`, `PATCH`, or `DELETE` printed the raw response
+body. All four now share the same message.
+
+**5. Three dead exports were removed from the agent memory surface.** `MEMORY_DOMAINS.ACTION_OWNED`
+was an empty array, `isActionOwnedKey` returned `false` for every input, and the `ActionOwnedKey` type
+resolved to `never`. They are gone. The live half of that layer is unchanged and still enforced: an
+agent still cannot write to a tool-owned memory key. If your project imports any of the three removed
+names, it was importing something that could never do anything — but the import will now fail, so it
+is worth a grep.
+
+## Applies to
+
+- **Every project that uses the `elevasis-sdk` CLI**, which is every template-family project. Items 1
+  through 4 arrive with the baseline bump and need no source edit from you.
+- **Any script or CI job that parses CLI stderr.** The gateway, timeout, and transport messages are
+  new text. If something greps for `API request failed`, check it.
+- **Any project importing `ACTION_OWNED`, `isActionOwnedKey`, or `ActionOwnedKey`** from the SDK, for
+  item 5. We found no such import in any template-family project, but only you can see out-of-tree
+  code.
+- **Not applicable to your organization model, knowledge nodes, workflows, or UI.** Nothing in this
+  train touches authored content or any rendered surface.
+
+## Required actions
+
+1. **Take the `@elevasis/sdk` baseline bump** this train propagates, then reinstall in `operations/`:
+
+   ```bash
+   pnpm -C operations install
+   ```
+
+2. **Grep for the three removed memory exports** before you deploy. This is the only change in the
+   train that can break a build, and it is cheap to rule out:
+
+   ```bash
+   grep -rn "ACTION_OWNED\|isActionOwnedKey\|ActionOwnedKey" operations/src core/config
+   ```
+
+   No output means item 5 does not affect you.
+
+3. **Redeploy `operations/`.** The baseline bump changes what your next bundle contains; it does not
+   change what is already deployed:
+
+   ```bash
+   pnpm -C operations exec elevasis-sdk deploy
+   ```
+
+4. **Check any script that matches on CLI error text.** If you have automation that branches on
+   `API request failed`, it will no longer match a gateway failure.
+
+## Verification
+
+- **Read the installed bundle, not the version number.** A bumped pin and a green sync report are
+  claims about intent; the installed file is the only ground truth:
+
+  ```bash
+  grep -c "GATEWAY_STATUSES" operations/node_modules/@elevasis/sdk/dist/cli.cjs
+  grep -c "ACTION_OWNED" operations/node_modules/@elevasis/sdk/dist/worker/index.js
+  ```
+
+  The first must be non-zero and the second must be `0`. Either result the other way means the
+  install did not land, regardless of what `package.json` says.
+
+- **Provoke a transport failure and read the message.** The cheapest honest check that the new
+  branches are live, because it needs no broken server:
+
+  ```bash
+  ELEVASIS_API_URL=http://localhost:9 pnpm -C operations exec elevasis-sdk list
+  ```
+
+  You should get a message naming the endpoint and saying the request never reached the API — not a
+  bare `fetch failed`.
+
+- **Confirm the timeout is configurable.** Setting `ELEVASIS_CLI_TIMEOUT_MS=1` on any command should
+  produce a timeout message that quotes the limit back to you.
+
+## Not handled by /git-sync
+
+- **The `operations/` reinstall.** `/git-sync` propagates and commits the dependency baseline. The
+  `node_modules` copy your CLI actually executes is not updated until you run `pnpm install` yourself,
+  and the CLI will keep printing the old messages until you do.
+- **The `operations/` redeploy.** Bumping the `@elevasis/sdk` pin changes what your next bundle
+  contains. Your currently deployed workers keep running the old bundle until you deploy.
+- **The grep for the removed memory exports.** Nothing can detect an out-of-tree import for you.
+- **Updating scripts that match on CLI error text.** The sync cannot see your automation.